Scammers allegedly used a lookalike email domain to impersonate a legitimate vendor and redirect a real city payment. The case shows how payment fraud can exploit routine administrative trust without breaching an organization’s internal systems.
The city of Liberty, Texas, lost about $600,000 after scammers allegedly impersonated a vendor the city actually owed money and redirected the payment to a fraudulent account. According to the Houston Chronicle, the attackers used a lookalike email domain designed to resemble the vendor’s legitimate address closely enough that the payment request initially appeared authentic. The city’s internal network was not compromised, officials said; instead, the fraud worked by manipulating the payment process around it.
That places the incident in the broader category of business email compromise, or BEC, a form of fraud built around impersonation, spoofed addresses and payment instructions that appear to come from trusted companies or executives. FBI guidance specifically warns organizations to verify changes in vendor payment information independently and to flag domains that differ by only a letter, character or extension from legitimate ones.
The financial scale is substantial. The FBI’s 2025 Internet Crime Report recorded more than $568 million in reported business-email-compromise losses among victims age 60 and older alone, while total cyber-enabled fraud losses across all categories exceeded $17.7 billion. Those numbers show why a scam does not need ransomware, malware or a dramatic breach to produce serious losses. In many cases, the vulnerable point is simply the moment when an employee is asked to change where money is sent.
What makes the Liberty case especially useful is that the fraudulent request reportedly involved a real outstanding debt. That makes the deception harder to detect than a random invoice. The transaction fit an existing business relationship, the amount was expected, and the request appeared to come from the company already waiting to be paid. The city transferred the money before the receiving bank flagged suspicious activity, according to the Chronicle. Liberty police are now working with federal law enforcement, and the city has filed an insurance claim.
The operational lesson is therefore less about better spam filters than about verification architecture. A city, company or nonprofit can have secure servers and still lose money if a single email is allowed to change bank information without an independent confirmation step. The FBI recommends two-step verification for wire transfers and direct confirmation of changes in vendor-payment destinations using contact information already on file rather than information supplied in the suspicious message.
Liberty says it is reviewing its vendor-payment procedures. That is where the story becomes larger than one Texas municipality. Digital administration has made paying vendors faster, but speed also creates an opening when organizations treat a familiar-looking email as sufficient proof of identity. The city did not have to be hacked for the money to leave. Someone only had to make the wrong message look enough like the right one.