Iowa City Loses $655,000 to Email Invoice Scam

An Iowa municipality lost over half a million dollars after a clerk paid a fraudulent invoice for a public works project.

Updated on Oct. 30, 2026 in Financial Crime

Bold flat-color editorial illustration of a simplified municipal building facade, evoking themes of institutional financial security and public trust. — The Iowa State Auditor's Office issued a warning after an Iowa municipality was defrauded of $655,000 by an email invoice phishing scam. AI Illustration. Upload story photo >

Live Poll

Do you trust that your local government has adequate safeguards to prevent cyber theft?

In October 2026, an Iowa city fell victim to a $655,000 financial scam involving a deceptive email invoice for a public works project. The fraud was uncovered only after the actual contractor contacted the city to request their payment.

Why it matters

The State Auditor's Office publicized this incident to warn other local governments about increasing attempts to steal public money through sophisticated email schemes. Two such scams were reported to the auditor's office within a single month.

A city clerk unknowingly paid a $655,000 invoice before the city successfully recovered $211,000 from a fraudulent account. An insurance claim has been filed to recover the remaining balance.

The players

State Auditor's Office

This government agency oversees the integrity of public finances and provides guidance on reporting suspected thefts or financial irregularities in Iowa.

The details

The city clerk received an email posing as a legitimate bill for a public works project, leading to the unauthorized disbursement of funds. Employees are now advised to verify all payment changes by calling vendors directly using contact information already on file.

In 2022, an attempted scam targeted the State Auditor's paycheck.
During October 2026, two fake email scams were reported to the State Auditor.

Legal Context

This incident highlights the critical importance of Iowa's reporting mandate requiring officials to disclose financial irregularities to the state. The case serves as a precedent for how municipalities should coordinate with state oversight to investigate modern digital theft.

Local government employees and residents are urged to remain vigilant against email-based invoice scams. Officials recommend that all vendors be contacted through established phone numbers before authorizing any changes to payment accounts.

The takeaway

Organizations should establish strict verification protocols that require verbal confirmation for all billing changes. Implementing these double-check procedures can prevent the loss of public funds to deceptive digital communications.