8 minmedium
The FBI Warned About Fake Permit Fees. The Harder Question Is Where the Money Goes.
A financially motivated fraud ring tracked by CYBERA under the name 'Diligent Planner' is impersonating US city and county planning departments to collect fake permit fees from property owners with active applications. The scheme exploits the fact that customer-authorized payments bypass behavioral fraud controls, making beneficiary mule accounts the primary detectable signal. The operation uses disposable webmail identities, US-based mule accounts operated by foreign actors, and is shifting toward instant P2P rails and smaller regional banks.
Conf:high
Detection / Hunteropenrouter
What Happened
Scammers are pretending to be local government planning departments and sending fake invoices to property owners who have real permit applications on file. Because the invoices include accurate permit details, victims believe they are legitimate and authorize wire transfers or peer-to-peer payments. Since the victim approves the payment, banks' automated fraud detection systems often do not flag it. Researchers at CYBERA identified 53 bank accounts used by one scam ring to collect stolen funds, with many accounts concentrated at just two banks. Anyone applying for building or zoning permits should verify any payment request directly with their local government office using official contact information, not the details provided in an email. Financial institutions should consider screening outbound payments against known mule account lists.
Key Takeaways
- FBI IC3 issued a public alert on March 9, 2026 about criminals impersonating city and county planning officials to collect fraudulent permit fees via wire, P2P, or cryptocurrency.
- CYBERA tracked a single ring ('Diligent Planner') since September 2025, identifying 53 verified mule accounts across 23 email campaigns, with ~55% concentrated in two beneficiary banks.
- Because victims authorize the payments, behavioral fraud detection models typically score these transactions as low risk — the key signal is the destination beneficiary account, not sender behavior.
- Email headers tie much of the activity to a Nigerian ISP alongside US hosting and likely VPN exits, while mule accounts are US-based to appear local.
- The ring is shifting toward smaller regional institutions and instant peer-to-peer payment rails, with card-based requests as a likely next step.
Affected Systems
- Property owners with active planning or zoning permit applications
- US-based financial institutions processing wire transfers and P2P payments
- Municipal and county planning departments whose identities are impersonated
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Target Selection: Actors pull public permit records to identify property owners with active planning or zoning applications
- Impersonation: Actors email targets posing as municipal planning department, citing real permit and property details for credibility
- Invoice Delivery: Official-looking invoice sent for a fake approval or processing fee
- Pressure: Actors demand wire/P2P/crypto payment on a short deadline, warning the application will fail if missed
- Confirmation: Actors request wire receipt to confirm payment landed
- Cashing Out: Funds routed to US-based mule accounts controlled by foreign operators for rapid downstream movement
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the article. The article describes a fraud intelligence capability (Recorded Future Money Mule Intelligence / CYBERA) that provides verified mule account lists for beneficiary screening, but no deployable detection logic is included.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | This is a social engineering and payment fraud campaign with no malware, endpoint compromise, or traditional cyber intrusion activity described. EDR tooling would not detect the fraudulent payment itself. |
| Network Visibility | Low | Email headers may reveal Nigerian ISP origins and free webmail infrastructure, but the core fraud occurs through authorized financial transactions. Network monitoring of email traffic could identify spoofed sender patterns but would not catch the payment fraud. |
| Detection Difficulty | Hard | The payments are customer-authorized, defeating behavioral anomaly detection built for account takeover. Detection requires external intelligence on verified mule accounts rather than internal telemetry. The ring rotates disposable webmail identities and uses US-based accounts to appear legitimate. |
Required Log Sources
- Email gateway logs (sender domain analysis, SPF/DKIM/DMARC failures)
- Wire transfer and payment processing logs
- Beneficiary account change request logs
- Bank account opening and transaction monitoring systems
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for inbound emails from free webmail services where the local part of the email address contains city, county, or state government names but the domain does not match an official .gov domain. | Email gateway logs, message tracing, SPF/DKIM/DMARC authentication results | Initial Access | Medium — legitimate businesses and individuals may use government-related names in email addresses; verify against known .gov sender patterns |
| Consider hunting for new beneficiary accounts added to payment systems that match known mule account patterns, particularly virtual-account structures associated with specific payment-processing platforms. | Payment processing logs, beneficiary change request records, account opening logs | Cashing Out | Low — if screened against verified mule account intelligence rather than heuristic scoring |
| Consider hunting for email headers showing routing through Nigerian ISP IP ranges combined with US-based beneficiary accounts in payment instructions. | Email header analysis, IP geolocation data, payment instruction records | Initial Access | Medium — legitimate users may route through VPNs or travel internationally; correlate with other indicators before acting |
| Consider hunting for clusters of payments to a small number of beneficiary banks from multiple unrelated senders within a short time window, which may indicate a shared mule network. | Transaction monitoring systems, wire transfer logs, cross-customer payment correlation | Cashing Out | Medium — popular banks naturally receive high volumes; focus on unusual concentration patterns and new beneficiary relationships |
Control Gaps
- Behavioral fraud detection models designed for account takeover will not flag customer-authorized payments to mule accounts
- Standard email security controls may not flag free webmail senders with government-impersonating local parts if SPF/DKIM/DMARC pass for the webmail provider
- Beneficiary screening workflows that lack external mule account intelligence will miss known fraudulent destination accounts
- Smaller regional institutions may have less mature fraud detection, which the ring is actively targeting
Key Behavioral Indicators
- Email sender local part contains city, county, or state government names while domain is a free webmail provider
- Email origin IP addresses tied to Nigerian ISP infrastructure
- Beneficiary accounts using virtual-account structures associated with specific payment-processing platforms
- Concentration of mule accounts at a small number of beneficiary banks (~55% at two banks in observed ring)
- Payment instructions demanding wire, P2P, or cryptocurrency for permit-related fees
- Email pressure tactics citing short deadlines and application failure consequences
False Positive Assessment
Medium — legitimate permit fees are real and property owners do pay them; the detection challenge is distinguishing authorized payments to legitimate government accounts from authorized payments to mule accounts. Email-based indicators (webmail with government names in local part) may produce false positives from legitimate users, while beneficiary account screening against verified lists would have lower false positive rates.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider screening outbound payments, new beneficiaries, and account change requests against verified mule account intelligence if available through your fraud prevention tooling.
- Consider alerting customers with active permit or zoning applications about this impersonation scheme, advising them to verify any fee requests directly with the municipal office via official contact information.
- If your institution processes payments for property owners or real estate transactions, consider enhanced review of beneficiary account changes and new payee additions involving permit-related fee descriptions.
Infrastructure Hardening
- Evaluate whether your email security gateway can flag inbound emails from free webmail providers where the local part contains government entity names but the sending domain is not a .gov domain.
- Consider implementing or enhancing beneficiary screening workflows to cross-reference outbound payments against external verified mule account lists before funds are released.
- If your organization operates a municipal planning department, consider publishing official payment guidance on your website and including fraud warnings in permit application correspondence.
User Protection
- Consider rolling out customer awareness communications about government impersonation scams, particularly for customers involved in real estate or construction projects.
- Evaluate whether your institution's transaction confirmation workflows can add friction (e.g., callback verification) for new beneficiary accounts receiving permit-related payments.
- If supported by your payment platform, consider implementing delayed settlement or hold periods for first-time beneficiaries matching high-risk patterns.
Security Awareness
- Consider incorporating government impersonation scam awareness into existing customer education programs, emphasizing that legitimate government offices will not pressure immediate wire transfers.
- If applicable to your organization, consider training front-line staff at financial institutions to recognize social engineering patterns in permit fee payment requests.
- Consider advising property owners to independently verify any invoice or fee demand by contacting the planning department through official government websites or phone numbers, not contact details provided in emails.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping4 techniques
Tactic
Resource Development
Tactic
Initial Access
Tactic
Execution
Additional IOCs
- Other:
Diligent Planner- Internal CYBERA tracking name for the active money mule ring impersonating US municipal planning departments; monitored since September 2025
