A California city sent $913,839.81 to scammers after they impersonated a contractor building a new sports complex and compromised a city employee’s email account to make fraudulent banking instructions appear internally verified.
The City of Pittsburg sent the ACH payment on February 12 believing the money was going to Discovery Builders Inc., the contractor working on the city’s Dream Courts recreational facility.
According to the San Francisco Chronicle, court records show the fraudsters used an email address resembling the contractor’s legitimate address but containing one additional lowercase “l.”
They then gained access to a city employee’s email account and used it to tell the finance department that the new banking information had already been verbally verified.
The deception was discovered five days later when the real Discovery Builders asked why it had not received the payment. Police froze the receiving account and recovered $696,241, while approximately $217,598 remains unrecovered and is the subject of an insurance claim.
One Extra Letter Helped Make the Payment Request Look Real
By pretending to be both a city employee and the developer of a recreational facility, scammers got staffers for the city of Pittsburg to send them a hefty payment. https://t.co/kfxw1D142f
— San Francisco Chronicle (@sfchronicle) August 8, 2026
Court documents say the fraudulent Discovery Builders email sent city employees updated bank-account information for the contractor. The address closely resembled the legitimate one, with the addition of a single lowercase “l.”
Investigators say the scammers compromised the email account of Sara Bellafronte, assistant to the city manager. Someone posing as Bellafronte emailed a finance department employee and claimed the new account information had already been verbally verified. The message instructed the finance employee to update Discovery Builders’ banking information.
Bellafronte told the Chronicle that she did not call a fraudulent verification number included in the documents. She said the city’s normal process required the finance department to call a vendor when banking information changed, but she did not know whether that verification call occurred.
The Real Contractor Asked Where Its Money Was
The city completed the $913,839.81 ACH payment on February 12. Five days later, Discovery Builders contacted Pittsburg because the company had not received the money it was expecting. That inquiry exposed the fraud.
The City of Pittsburg said employees identified the transaction as fraudulent on February 17 and immediately notified police. Pittsburg police froze the receiving account and expanded the investigation to include Contra Costa County authorities and the FBI. The quick response allowed authorities to recover $696,241.
That left approximately $217,598 of the original transfer unrecovered. The city is seeking reimbursement for that amount through its cyber and crime insurance policies.
About $217,000 Was Converted Into Bitcoin
As investigators followed the transferred money, they traced part of it to a man in Illinois who court records indicate may himself have been manipulated by the larger operation.
The man believed he was working for a legitimate company called Tyco Alloy Industries, according to the Chronicle. Investigators say he used roughly $217,000 to purchase bitcoin and then transferred the cryptocurrency to a digital wallet. Investigators reportedly believed he may also have been a victim of the broader scheme.
Tracing the operation has required 18 search warrants involving 116 accounts associated with technology companies, financial institutions and telecommunications providers. City officials say evidence points to a primary suspect in Nigeria who was responsible for compromising Pittsburg’s email system.
Investigators have also identified at least two suspected criminal associates in the United States. No suspect has been publicly named or arrested. The FBI and U.S. Attorney’s Office have accepted the case for continued investigation.
The Contractor Eventually Received the Full $913,839
Discovery Builders President Louis Parsons said he did not blame Pittsburg for falling victim to the operation. The contractor ultimately received the full $913,839 it was owed within 60 days after discovering that the original payment had been diverted.
Discovery Builders also changed how it accepts payments connected to Dream Courts. A company representative now physically picks up checks rather than relying on the same electronic payment process. Pittsburg implemented additional controls after the incident, including stronger ACH verification procedures, changes to financial workflows and modifications to IT staffing.
The city waited until August to publicly disclose the February fraud because investigators determined that releasing the information earlier could have interfered with the case.
Banking Changes Should Be Verified Outside the Email Chain
Organizations should treat any request to change a vendor’s bank account or payment method as a separate verification event, even when it arrives inside an existing email conversation. The FBI recommends calling the vendor through a telephone number obtained independently or already stored in company records.
Finance teams should also inspect the complete sender address rather than relying on the displayed name. A single added, removed or substituted letter in an email domain can be enough to redirect a payment.
Large transfers and changes to vendor banking information should require independent approval from a second employee. Organizations should also use multifactor authentication on email accounts and investigate unexpected forwarding rules, login activity or changes to account security.
If a fraudulent ACH or wire payment has already been sent, the financial institution should be contacted immediately and asked to freeze or recall the transfer. The FBI also advises victims to report business email compromise through IC3.gov as quickly as possible because rapid reporting can improve the chances of recovering money before it moves through additional accounts.