FBI Alert: Phishing Email Impersonating Local Planning/Zoning Officials

PDF

On March 10^th, the FBI issued an alert warning of an emerging scheme whereby criminals impersonating city and county officials solicit fraudulent payments for city / county planning and zoning permits.

Summary:

In this nationwide scam, the threat actors identify potential victims through publicly available permit information and then send unsolicited emails citing such information to instruct victims to pay invoices for fees related to their permits via wire transfer, peer-to-peer payment, or even cryptocurrency (note: a major red flag). As the latest variant on an ever-increasing frequency and sophistication of social engineering scams, here are some common indicators to watch out for:

• The emails contain detailed, accurate information about planning and zoning requests, including property addresses, case numbers, and the true names of city and county officials.
• The emails use professional language, formatting, and imagery consistent with legitimate government communications for planning and zoning applications, including review processes, planning commission procedures, regulatory compliance, and relevant ordinances.
• The email addresses contain usernames similar to city or county planning and zoning departments but originate from non-governmental domains, such as "@usa.com"
• Email delivery may be timed to coincide with ongoing communications with city and county officials regarding the permitting process.
• Attached PDF invoices contain itemized statements of purported fees and direct applicants to request payment instructions via email, rather than telephone, to ensure a reliable audit trail for all correspondence related to the application. This is designed to deter the victim from calling the city or county office to verify the fees.
• The emails emphasize urgency, threatening delays or other obstacles in the permitting process if the applicant does not immediately render payment.

Tips To Protect Yourself:

• Do not assume emails are legitimate based on use of city/county letterhead, seals, official names, or proper spelling / grammar.
• Carefully verify that the email address (including domain name) matches that of the official with whom you are corresponding and does not contain extraneous characters or misspellings.
• Check the official website for notices about ongoing impersonation schemes.
• Call the local government, using the phone number from the official website (not from the email!) to verify outstanding fees.

If you think you have received such an email, or if you have fallen victim and wired money, please call us immediately for help in remediating and reporting the situation.