{"id":68110,"date":"2025-09-02T15:25:11","date_gmt":"2025-09-02T20:25:11","guid":{"rendered":"https:\/\/www.pcmatic.com\/blog\/?p=68110"},"modified":"2025-09-02T15:26:58","modified_gmt":"2025-09-02T20:26:58","slug":"vendor-fraud-in-baltimore-what-local-governments-can-learn-and-how-pc-matic-helps","status":"publish","type":"post","link":"https:\/\/www.pcmatic.com\/blog\/vendor-fraud-in-baltimore-what-local-governments-can-learn-and-how-pc-matic-helps\/","title":{"rendered":"Vendor Fraud in Baltimore, What Local Governments Can Learn and How PC Matic Helps"},"content":{"rendered":"\n

The City of Baltimore reports that a scammer successfully spoofed a vendor and persuaded staff to change banking details inside a financial system. Two large payments were routed to the impostor. The city recovered one of them, but more than a million dollars was lost before the scheme was discovered. This incident reinforces a familiar pattern in public sector risk. Process gaps, social engineering, and insufficient technical guardrails often converge. The result is financial loss and a hit to public trust.<\/p>\n\n\n\n

This post explains how the scam worked, why municipalities remain attractive targets, and how to combine stronger business processes with prevention-first cybersecurity. It also maps those lessons to practical steps and highlights how PC Matic<\/a> helps local governments reduce risk in the real world.<\/p>\n\n\n\n

<\/div>\n\n\n\n

What Happened, A Quick Walkthrough<\/h2>\n\n\n\n

Based on the city\u2019s own description, a fraudster impersonated a legitimate company employee, submitted a supplier contact form, and gained access tied to a vendor profile in Workday. The request used a non-company email and spoofed identity. Multiple requests were made to change linked bank accounts. Two staff members approved changes. Accounts payable then sent two large payments to the wrong destination. A bank later flagged suspicious activity, which led to discovery. The city has since said it will tighten verification procedures, restrict permissions, and expand training to spot social engineering.<\/p>\n\n\n\n

The mechanics are straightforward. A convincing sender, a plausible business request, and a rushed environment. That is the modern recipe for vendor fraud. The fix is not one thing. It is stronger verification in finance, tighter access controls in the system of record, and cyber controls that reduce the attacker\u2019s room to maneuver.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Why Local Governments Are High-Value Targets<\/h2>\n\n\n\n

Municipalities manage payrolls, procure critical goods and services, and maintain essential systems. Budgets are public, processes are predictable, and staff often juggle high volumes with limited time. Attackers exploit that reality. They either redirect money through vendor spoofing and business email compromise, or they disrupt services to create leverage for extortion.<\/p>\n\n\n\n

The takeaway is simple. Cities and counties must assume adversaries are probing both financial processes and IT systems. Controls must reinforce each other. Verification procedures reduce the chance of a bad change request. Cyber controls reduce the blast radius if an attacker gains any foothold.<\/p>\n\n\n\n

<\/div>\n\n\n\n

The Weak Links, Where Scammers Win<\/h2>\n\n\n\n

Vendor fraud that changes banking details usually cracks three layers at once.<\/p>\n\n\n\n

1 – Human Verification<\/h5>\n\n\n\n

If a request uses a new email, an unexpected contact, or a hurried tone, a direct confirmation using a known phone number should be mandatory. When that callback does not happen, attackers win.<\/p>\n\n\n\n

2 – System Permissions<\/h5>\n\n\n\n

If anyone can submit a sensitive change and two colleagues can approve it without additional checks, the process is fragile. Restricted roles, least privilege, and dual control for banking updates are essential.<\/p>\n\n\n\n

3 – Endpoint and Identity Hygiene<\/h5>\n\n\n\n

Many vendor fraud schemes begin with a phish. One clicked link can harvest credentials. If malware or unauthorized remote tools can run freely on endpoints, adversaries can plant persistence, bypass multi-factor prompts, or stage automated change requests behind the scenes.<\/p>\n\n\n\n

Baltimore\u2019s new commitments after the incident point in the right direction. Cross-verification for bank changes, restricted roles for sensitive updates, and training for staff who handle vendor data are foundational steps that other cities can mirror.<\/p>\n\n\n\n

<\/div>\n\n\n\n

How PC Matic Protects Local Government<\/h2>\n\n\n\n

PC Matic <\/a>offers a streamlined, effective allowlisting solution built specifically to meet the needs of organizations with limited cybersecurity staff and high operational risk\u2014including municipal and county governments.<\/p>\n\n\n\n

Key Benefits for Local Agencies:<\/h5>\n\n\n\n