Products Lemma APIProof issuance & verification platformTrust402Delegate to agents, and transactSealSign-in for the agent era — no keys handed over
Use cases Manufacturing & Critical InfraInspection Record AssuranceFinance & FinTechCounterparty Record VerificationPublic SectorCertificate-less ProceduresHealthcareQualified Worker AssuranceProcurement & Supply ChainSupplier Credential MonitoringMedia & ContentContent AuthenticityService & RetailCross-group IdentityAI Adoption (cross-industry)AI Run GovernanceDevelopers & Agent OpsAgent Authority Control ▸ Browse the use-case index
Pricing
Resources Critical BriefThe frontier of AI × trustBlogThinking and implementation notesDocumentationAPI & specsVerification CenterReal verification & issuance countsAbout usFRAME00, Inc.ContactSales & press inquiriesGlossaryDefinitionsFAQFrequently asked questions
Get Started ↗ JA
Home / Critical Brief / No. 158
No. 158 Critical Brief · Regulatory Attribute Proof

City of Portland: An impostor used a password-reset link to enter a contractor's supplier account and had a construction payment sent elsewhere (US DOJ and others)

Nothing checks a new bank account against the supplier's registered contact before paying

$6.7M
A water-plant construction payment owed to the contractor, sent to an account named by the impostor (US DOJ)
03-21→03-25
From the city's transfer to the receiving bank flagging possible fraud (press, citing the city's affidavit)
Allrecovered
Returned to the city by the US Marshals Service in August 2025 (press)
CountryUS
Incident date2025-03-21
Published2026-10-24
AuthorsLemma Critical Team
Contents
  1. 01TL;DR
  2. 02What happened
  3. 03Timeline — disclosure and response
  4. 04Why it wasn’t stopped
  5. 05How to counter this
  6. 06Sources

TL;DR

  1. 01What happened

    In March 2025 the City of Portland, Oregon, sent $6.7 million owed to the joint venture building its water filtration plant to an account named by someone posing as one of the contractor’s employees. The impostor had changed the contractor’s bank account in SAP Ariba, the city’s supplier system (US DOJ; press citing the city’s affidavit).

  2. 02Why it went through

    The city had not acted on an earlier emailed change after its check to the contact on file went unanswered. The impostor then asked for the password-reset link to be resent, and it reached the impostor. From there, the change looked like the contractor’s own legitimate edit.

  3. 03The missing layer

    On March 25 the receiving bank flagged possible fraud and the city asked for the payment to be blocked; the funds were still in the receiving account, were seized in April and later fully returned. The March 21 transfer still went out. What failed was the layer that checks a new bank account against the supplier’s registered contact before paying.

What happened

Party
The City of Portland, Oregon. A joint venture of MWH Constructors and Kiewit (MWH-Kiewit) is building the Water Bureau’s Bull Run Filtration Project, a roughly $2.1 billion plant.
Who was impersonated
A proposal manager at MWH, listed as the contract contact in the city’s vendor database (press, citing the city’s lawsuit). The city does not believe the employee committed the theft; the name was used.
Loss
A $6.7 million construction payment went to an account named by the impostor. On April 16, 2025, the FBI seized $6,748,680 still in that account (US DOJ). In August the US Marshals Service returned the funds to the city (press).
Receiving account
An attorney trust account in the name of a New York law firm. The city briefly sued the firm, then dropped the suit after the firm showed it was also a victim (press).
Initial access
Whether the impostor had broken into the contractor’s email has not been disclosed. ENR says the case probably started with an email breach through phishing (speculation). No arrests had been made as of September 2025.

Glossary
SAP Ariba — A cloud service for managing supplier records, invoices and payments. Portland rolled it out in February 2025 and required its contractors to use it.
Password-reset link — A link sent when someone cannot log in, used to set a new password. Whoever receives it can get into the account.
Civil forfeiture — A civil procedure that lets the government seize criminal proceeds and return them to victims without waiting for a criminal conviction.

The attack ran as follows (per ENR, citing the city attorney’s affidavit).

Exhibit 1The chain, as far as disclosed

The stopping point is ③. Had the link's destination, or the new bank account, been checked against the supplier's registered contact, the transfer in ④ would not happen. The check in ① worked.

City
1
Checks an emailed bank-change request with the contact on file

February 2025. A bank account confirmation letter was attached. The check went unanswered, and the city made no change.

Impostor
2
Told to use SAP Ariba, asks for the reset link to be resent

Asked for it to go to an address that looked like the same one.

Impostor
3
Uses the link to enter the supplier profile and adds a new account

The link reached the impostor, not the employee.

City
4
Sends $6.7M to the account on file

March 21. Settlement date March 25.

Banks, city
5
The receiving bank flags possible fraud; the city asks to block the payment

March 25. The funds were still in the receiving account.

Timeline — disclosure and response

  • The city rolls out SAP Ariba and requires contractors to use it. The same month, an email in an MWH employee’s name asks to change the bank account. The city sends a check to the contact on file; it goes unanswered, and no change is made. The impostor then asks for the reset link to be resent, and the city sends it.
  • The city transfers $6.7 million. Settlement date is March 25.
  • The impostor emails that the bank details were wrong and asks to switch to another account. ENR says this attempted switch apparently set off the fraud alarm.
  • Chase, the receiving bank, alerts Wells Fargo, the city’s bank, to possible fraud. The city’s deputy controller orders the payment rejected or blocked.
  • The impostor starts calling the city to ask about the payment (10 calls in all).
  • The Water Bureau confirms the MWH employee was impersonated.
  • The FBI obtains a warrant and seizes $6,748,680.
  • The US Attorney’s Office for the District of Oregon announces a civil forfeiture action.
  • The US Marshals Service returns the funds to the city.

The February requests and the March 21–25 events rely on ENR’s reporting of the city attorney’s affidavit; we have not seen the affidavit itself. The February change (an impostor accessed a payment system and changed the bank account) and the seizure amount and date rely on the US DOJ release (primary). Whether the link went to an address imitating the contractor’s has not been disclosed. The DOJ dates the change to February; ENR’s sequence puts the link and the change about two weeks before March 21, possibly in early March.

After disclosure

  • City of Portland: Sued the New York law firm holding the receiving account to keep the funds from moving, then dropped the suit after the firm cooperated with the FBI and showed it was also a victim (press). The mayor said fast action by local and federal law enforcement stopped the transfer “before it landed in the wrong hands” (press).
  • US DOJ: Urged victims of similar scams to contact law enforcement without delay, noting the recovery was possible only because the city reported it.

Why it wasn’t stopped

The failure was neither in spotting the email nor in the bank’s detection. An operation that switched the supplier’s bank account took effect, and was used for payment, without being checked against the supplier’s registered contact.

The core of this case
The emailed request to change the bank account was stopped by a check sent to the contact on file. The password-reset link for the supplier account that followed reached the requester, and the bank account was switched there.
Exhibit 2The gap between detection and proof

Proof here means checking, before paying, that a new bank account really belongs to the supplier, through the supplier's registered contact, and keeping a record. Detection means noticing possible fraud after the transfer.

Proof layer · absentCheck a new account with the supplier before paying
Gap$6.7M went to
another account
Detection layer · workedThe receiving bank flags possible fraud
STEP 1
Reset link to the impostor
STEP 2
Bank account switched
STEP 3
03-21 transfer
STEP 4
03-25 bank alert

The first emailed request was stopped by a check with the contact on file, but nothing says where the reset link was sent was checked, and a change made through it is indistinguishable from the supplier’s own edit. The money came back through the receiving bank’s alert and the seizure; the transfer itself went through. That distance is the gap between detection and proof, and it is structural.

The same structure appears in Polaris Holdings / Booking.com (a hotel’s payout account was switched in the legitimate admin screen).

How to counter this

Activate a supplier’s bank account change only once it is confirmed through the supplier’s registered contact, whatever path it arrives by: an emailed request, a supplier’s own edit in a portal, or an edit after a password reset. Then an impostor who obtains a login still cannot redirect payments. It sits in front of detection, not in place of it.

Industries and operations to watch

IndustryPublic sector
Cities and public bodies with many contractors and large payments. Contractor and contact names are visible in public bids and contracts.
IndustryConstruction
Large projects run long chains of payments from owners and general contractors. Pauses and restarts are often public.
OperationBank account changes
Changes to a supplier’s bank account, and resets of a supplier’s login.

Do today’s controls close it?

ControlThis caseWhy
Check with the contact on filePartialWorked: the emailed bank-change request went unanswered, so nothing was changed. Did not: nothing says the reset link’s destination was checked, and the link reached the impostor.
Supplier self-service portalIneffectiveDid not: an impostor with the login looked like the supplier, and the bank-detail change went through.
Bank fraud detectionPartialWorked: four days after the transfer, the receiving bank flagged it, and the seizure brought the money back. Did not: the transfer itself was not stopped.
Staff trainingPartialWorked: staff caught the first emailed request. Did not: the reset link, a different path, got through.
ControlsWhat is needed
  1. Put bank changes and login resets through the same check. Activate either only when confirmed through the supplier’s registered contact. Never send to an address the requester supplies.
  2. Check that a new account belongs to the supplier before paying. Match the account holder to the supplier before any payment.
  3. Record who approved the change, and on what check. Look at that record before paying, and pay only to accounts that carry it. Keep it in a form a third party can verify later, as proof.
CheckChecklist

Three things to confirm about supplier bank accounts

  • Can a reset of a supplier’s login be sent anywhere other than the registered contact?
  • Do you hold payments to a newly changed account until the check is done?
  • Do you confirm bank changes through the registered contact, not a contact found in the email that asked for the change?

Note: if the supplier’s registered contact itself is compromised, this check can be passed. And it protects where payments go; an impostor falsifying what an invoice asks for still needs separate controls.

Sources

  1. PrimaryUS Attorney’s Office, District of Oregon “United States Files Forfeiture Action to Recover $6.7 Million in Stolen Funds”2025-05-23 · justice.gov/usao-or/…
3 more (reporting, analysis)
  1. Press, citing the city attorney’s affidavitENR “How Portland, Ore., Recovered a Stolen $6.7M Payment Meant for MWH-Kiewit”2025-09-19 · enr.com/articles/…
  2. Press, citing the city’s lawsuitWillamette Week “Feds Investigate $6.7 Million in Stolen Vendor Payments From Bull Run Filtration Project”2025-04-23 · wweek.com/news/…
  3. PressWillamette Week “City Recovers $6.7 Million From Scam That Targeted the Water Bureau”2025-08-29 · wweek.com/news/…

References: “The last layer left in AI-era cyber defense”

The same method elsewhereSee all 7 "Payee & bank-account changes" cases Get new cases and checks like these by email

This material is a structured analysis of public information; it is not an audit, diagnosis, or recommendation for any specific organization.

Cite this Brief

Lemma Critical Team. (2026).
"City of Portland: An impostor used a password-reset link to enter a contractor's supplier account and had a construction payment sent elsewhere (US DOJ and others) — Nothing checks a new bank account against the supplier's registered contact before paying".
Lemma Critical Brief No.158. Lemma / FRAME00, Inc.
https://lemma.frame00.com/critical/briefs/158-portland-water-bureau-vendor-bank-change/
Lemma

If it can't be verified,
it doesn't enter your operation.

Lemma attaches cryptographic proofs to data and AI execution, so the receiving side can confirm authenticity without asking the issuer. Detection stays; a proof layer is added in front of it.

Talk to enterprise See the verification center