City of Mobile releases detailed timeline on $14.7M fraud case
Nov 11th, 2026
Posted in: Press Release
The City of Mobile is providing a more detailed timeline of the fraudulent diversion of $14.7 million intended for BL Harbert International, the general contractor building Regions Arena. The criminal investigation remains ongoing.
Timeline of Events:
May 22: Initial contact
The person posing as a representative of BL Harbert International first contacted the City's Finance Department on May 22, 2026. The message presented the request as a routine vendor-record update, stating that the company needed to submit an updated form but no longer had access to the usual process following a staffing change. This began a series of communications that continued for more than four months.
May 26–27: False documents submitted and vendor record updated
City staff provided the standard vendor information packet used when businesses establish or update their information. On May 26, the impersonator returned completed forms and supporting documentation containing fraudulent banking information. The City's vendor information was updated on May 27. The person making the request had not been independently authenticated through an established contact at the legitimate company.
June 12–22: A second set of banking instructions
In June, the impersonator claimed that the company's banking information needed to change again because of an internal audit. Additional forms and banking documents were submitted, and the City's vendor records were updated again on June 22. The repeated requests made the correspondence appear to be part of an ongoing administrative process, even as the requested payment details changed.
July 9–24: Authentic City records obtained; request reaches senior Finance staff
In July, the impersonator sought information about earlier payments and asked whether future payments would use the banking details already submitted. On July 13, another set of vendor forms led to a third update of the City's vendor records. On July 23, City staff provided records reflecting actual prior transactions with BL Harbert. The impersonator later relied on those genuine details to establish credibility in communications with other employees.
The request then reached more senior finance personnel after staff explained that payments for Regions Arena were handled through a separate banking process. This distinction was important: changes to the City's internal vendor records did not automatically alter the instructions used to make arena construction payments.
Late July–September 24: Efforts to change the bank's payment instructions
By late July, senior Finance staff were communicating with the impersonator about future arena payments and the request to change how those payments would be delivered. City staff sent updated payment information to the banking partner in late July and again during the following weeks. The bank did not immediately change the payment instructions for the vendor, and at least one later arena payment continued to reach the legitimate contractor's existing account.?
The impersonator continued following up about expected payments and the requested change. After additional communications, the City provided the updated information to the bank again, and on September 24, City staff were informed that the bank had received the information and updated the payment instructions. Those instructions were fraudulent.
October 2–5: Legitimate payment redirected
On October 2, the City submitted payment instructions for a legitimate Regions Arena invoice totaling approximately $14.7 million. Although the invoice and the contractor were legitimate, the account designated to receive the money was not. The payment was directed to the fraudulent account.
October 7–16: Missing payment reported and fraud confirmed
On October 7, BL Harbert notified the City that it had not received the expected payment. On October 8, the City received information from its bank that the contractor should have received the funds on October 5. A trace number was received, but staff did not elevate the matter for further review. Upon further follow-up by the project manager on October 13, the tracking information was promptly forwarded to BL Harbert, though the matter was not further escalated to City leadership. The internal BL Harbert chain responded two days later. In an October 16 email exchange with the contractor, the bank receiving the payment was identified. BL Harbert immediately advised that it did not have an account at that institution, confirming that the payment had been directed to a fraudulent account. Recovery efforts and contact with federal law enforcement began immediately on October 16.?
What the City Has Determined
The City's review has identified multiple mistakes and failures by employees. Changes purportedly requested by the contractor were accepted without independent confirmation of the requester's identity. Employees missed warning signs as banking instructions repeatedly changed, shared genuine City payment records with the impersonator, failed to escalate the missing-payment discrepancy after the bank indicated the contractor should have received the funds, and failed to correctly notice small mistakes and social cues by the threat actor over four months. These allowed the scheme to progress and delayed its discovery.
Response and Next Steps
The City has reorganized and strengthened verification and approval requirements for changes to vendor banking information and payments, and has modified how large payments are handled. It continues working with federal authorities and outside specialists to recover funds, assess controls and make further improvements.