City of Baltimore lost $1.5 million to a vendor impersonation scheme

Baltimore's Office of the Comptroller disclosed on 1 April 2025 that the city had been defrauded of more than $1.5 million by someone impersonating a legitimate city vendor.

The scheme began in December 2024, when the fraudster submitted a supplier contact form using the name of a real employee at the vendor and gained control of the vendor's record in the city's Workday system. Repeated requests to change the linked bank account followed, backed by a forged voided cheque in January 2025. Accounts payable staff approved the changes without verifying the requester, even though the correspondence did not come from a company issued email address.

Two payments then went to the fraudulent account: $803,384.44 on 21 February 2025 and $721,236.60 on 10 March 2025, a total of about $1.52 million. The city was alerted on 13 March after the receiving bank flagged suspicious activity, and it froze the vendor account. The smaller payment was recovered. The larger was not, and the city filed an insurance claim while reimbursing the vendor for both transactions.

Deputy comptroller Erika McClammy told local media the attacker had bypassed the city's geofencing controls using Starlink internet addresses, but the city's information technology office later confirmed to the Inspector General that Starlink played no role. An Inspector General report by Isabel Mercedes Cumming later found that accounts payable had not adopted safeguards recommended after comparable frauds in 2019 and 2022, and did not require phone verification of banking changes. Accounts payable director Timothy Goldsby Jr. described new cross verification steps, restricted Workday roles and social engineering training.