Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<div>
<div>A fast-growing scam impersonates city and county planning departments, sending property owners real-looking invoices for fake permit fees and pressuring them to wire payment on a deadline. Because the victim authorizes the transfer, payments commonly clear the behavioral checks built to catch fraud, making beneficiary accounts one of the most reliable signals to track this campaign. Research from CYBERA, the partner behind Recorded Future® Money Mule Intelligence, maps a single active ring down to the verified accounts it used, and shows why direct, fraudster engagement and account-level intelligence catches what scoring misses.</div>
</div>
</div>
<h2><br />The FBI sounded the alarm. Issuers still can't see it</h2>
<p>On March 9, 2026, the FBI's Internet Crime Complaint Center <a href="https://www.ic3.gov/PSA/2026/PSA260309" rel="noreferrer" target="_blank">issued a public alert</a> about criminals impersonating city and county officials to collect fraudulent planning and zoning permit fees. The criminals pull publicly available permit records, email property owners who have active applications, and demand payment by wire transfer, peer-to-peer transfer, or cryptocurrency.</p>
<p>Government impersonation schemes like this one were among the fastest-growing categories in the FBI's <a href="https://www.fbi.gov/file-repository/2025_ic3report.pdf/view" rel="noreferrer" target="_blank">2025 Internet Crime Report</a>, with reported losses nearly doubling year over year to roughly $798 million. While the alert raises public awareness, it does little to help issuers screen customers payments against the heightened risk these impersonation scams create.</p>
<h2>Why an authorized payment defeats your controls</h2>
<p>In this scheme the customer is real, the login is legitimate, and the wire is one the customer chooses to send. Behavioral analysis models are generally built to flag account takeover and out-of-pattern activity, so customer-authorized payments tend to score as low risk and the money moves.</p>
<p>These fraud signals don’t live in the sender's behavior. They live in the destination: the beneficiary (or mule) account that the scammer will use to cash out the stolen funds. That makes this mule account <a href="https://www.recordedfuture.com/blog/money-mule-solution" rel="noreferrer" target="_blank">the one signal that often separates a legitimate payment from a scam payment</a>.</p>
<p>Here is how the scheme runs, according to the FBI alert and <a href="https://www.cybera.io/" rel="noreferrer" target="_blank">CYBERA's</a> research:</p>
<ol>
<li><strong>Target selection</strong>: the actors identify property owners with active planning or zoning applications using public records</li>
<li><strong>Impersonation</strong>: they email those owners while posing as the municipal planning department, citing real permit and property details to establish credibility with the target</li>
<li><strong>The invoice</strong>: they send an official-looking invoice for an approval or processing fee</li>
<li><strong>The pressure</strong>: they demand a wire on a short deadline and warn that the application will fail if it is missed</li>
<li><strong>The confirmation</strong>: they ask for the wire receipt to confirm the payment landed</li>
</ol>
<h2>What direct engagement reveals that scoring cannot</h2>
<p>CYBERA's research on one active ring, which it has monitored since September 2025 under the internal name Diligent Planner, shows what that destination signal looks like in practice. Rather than estimating risk, CYBERA's analysts engage the scam operations directly and collect the exact accounts the criminals ask victims to wire money to.</p>
<p>Across this single operation, that approach produced 53 verified mule accounts spanning 23 separate email campaigns, with roughly 55 percent of the accounts concentrated in just two beneficiary banks. These are confirmed accounts pulled from the criminals themselves, not probabilistic matches, which can be the difference between an account you can act on and a score you have to second-guess.</p>
<div>
<div>
<div>
<img alt="A network mapping visualization showing a single money mule ring, featuring interconnected nodes that represent beneficiary bank accounts, email campaigns, and impersonated government bodies." height="720" src="https://www.recordedfuture.com/media_1f0ae6960051a4823e36fd9ae5f3f673ec6ce3331.png?width=750&format=png&optimize=medium" width="1798" />
</div>
</div>
<div>
<div><strong>Figure 1:</strong> CYBERA's mapping of a single money mule ring, expanded from one beneficiary bank into one connected cluster of accounts, emails, and impersonated government bodies (Source: CYBERA)</div>
</div>
</div>
Article Link: The FBI Warned About Fake Permit Fees. The Harder Question Is Where the Money Goes. | Recorded Future