Products Lemma APIProof issuance & verification platformTrust402Delegate to agents, and transactSealSign-in for the agent era — no keys handed over
Use cases Manufacturing & Critical InfraInspection Record AssuranceFinance & FinTechCounterparty Record VerificationPublic SectorCertificate-less ProceduresHealthcareQualified Worker AssuranceProcurement & Supply ChainSupplier Credential MonitoringMedia & ContentContent AuthenticityService & RetailCross-group IdentityAI Adoption (cross-industry)AI Run GovernanceDevelopers & Agent OpsAgent Authority Control ▸ Browse the use-case index
Pricing
Resources Critical BriefThe frontier of AI × trustBlogThinking and implementation notesDocumentationAPI & specsVerification CenterReal verification & issuance countsAbout usFRAME00, Inc.ContactSales & press inquiriesGlossaryDefinitionsFAQFrequently asked questions
Get Started ↗ JA
Home / Critical Brief / No. 160
No. 160 Critical Brief · Regulatory Attribute Proof

City of Baltimore: A fake contact posing as a supplier's employee was added to the supplier's account, and its bank account was switched (city Inspector General report)

Nothing checks a new contact or a bank change with the supplier's registered contact

$1.52M
Two payments owed to a supplier went to the fake contact's account. About $0.8M had not been recovered at the time of the report (city Inspector General)
12-09→02-19
From the fake contact's request to join the supplier account to the bank account being switched (city Inspector General)
2 levels
of approval on the bank change. Checking with the supplier was not required by procedure (city Inspector General)
CountryUS
Incident date2025-02-21
Published2026-10-24
AuthorsLemma Critical Team
Contents
  1. 01TL;DR
  2. 02What happened
  3. 03Timeline — disclosure and response
  4. 04Why it wasn’t stopped
  5. 05How to counter this
  6. 06Sources

TL;DR

  1. 01What happened

    In February and March 2025 the City of Baltimore, Maryland, sent two payments totaling $1.52 million, owed to a supplier, to an account controlled by someone posing as one of the supplier’s employees. The impostor first got added as a supplier contact in Workday, the city’s procurement system, then submitted a bank change with a forged voided check; the account was switched on February 19 (city Inspector General report).

  2. 02Why it went through

    A city employee approved the new contact without contacting the supplier (Inspector General). Two more approved the bank change, but the rules at the time required neither a call to the supplier nor a list of its authorized signers.

  3. 03The missing layer

    On March 13 a bank alert tipped off the city and the second payment came back. About $0.8 million from the first had not been recovered at the time of the report. What failed was the layer that checks new contacts and bank changes with the supplier’s registered contact.

What happened

Party
The City of Baltimore’s Department of Accounts Payable, under the Comptroller, which handles city payments. Since August 2022 the city has used Workday for procurement and supplier management; suppliers update contacts and bank accounts there. Contact requests are handled by the Bureau of Procurement and by Accounts Payable.
Who was impersonated
A supplier employee. The name on the impostor’s request matched that employee, who has no role in the supplier’s finances. The email address given was not one the supplier issues to staff.
Loss
$803,384.44 on February 21, 2025 and $721,236.60 on March 10, a total of $1,524,621.04, went to the impostor’s account. The second came back. The first had not been recovered at the time of the report. The city filed an insurance claim. The supplier was paid again for both.
How it came to light
On March 13, the bank holding the impostor’s account called the city’s bank about possible fraud, and the city’s finance department was told.
Initial access
How the impostor obtained the supplier employee’s details has not been disclosed. The Comptroller’s office initially told the press the impostor bypassed the city’s geofencing with a Starlink IP address; city IT staff told the Inspector General Starlink played no part in the Workday access.

Glossary
Workday — A cloud service for HR and procurement. Since 2022 Baltimore has used it for suppliers to view invoices and payments and to update contacts and bank accounts.
Voided check — A check marked VOID so it cannot be cashed. In the US it is often attached to bank-account registrations as proof of the account number.
Office of the Inspector General (OIG) — An independent city office that investigates fraud and waste in city government and publishes public synopses of its findings.

Per the Inspector General’s report, the attack ran as follows.

Exhibit 1The chain, as far as disclosed

The stopping points are ② and ③. Had the new contact and the bank change been checked with the supplier's registered contact, the payments in ④ would not happen. City approvals were in place at ② and ③.

Impostor
1
Poses as a supplier employee and asks to be added as a contact

December 9, 2024. Used an email address the supplier does not issue.

City
2
Approves the request and adds them to the supplier account

December 11. Some details on the request did not match the record.

Impostor, city
3
Submits a bank change with a forged voided check; it is approved

One approved on January 10, 2025, then another. Both said they did not recall seeing the voided check. Workday records show city staff switching the account on February 19.

City
4
Sends two payments, $1.52M in all, to the switched account

February 21 and March 10.

Banks, city
5
The receiving bank flags possible fraud

March 13. The second payment came back.

Timeline — disclosure and response

  • The impostor, posing as a supplier employee, asks to be added as a contact.
  • A city employee approves the request and adds the impostor to the supplier account. From that day the impostor tries several times to change the bank account.
  • The impostor submits a bank change with a forged voided check in the supplier’s name.
  • A city employee approves the change submitted on January 7; another then approves it (date not given).
  • The impostor emails the city asking about an invoice and to switch the bank account (again on February 5).
  • After the impostor’s emailed requests, Workday records show a city employee switching the supplier’s bank account to the impostor’s.
  • $803,384.44 goes to the impostor’s account.
  • $721,236.60 goes out; it is later returned to the city.
  • The bank holding the impostor’s account alerts the city’s bank to possible fraud.
  • The Inspector General receives a complaint.
  • Accounts Payable responds to the Inspector General’s report.
  • The Inspector General publishes a public synopsis.

The facts rely on the Inspector General’s public synopsis and Accounts Payable’s response (both primary). The synopsis summarizes a fuller report given to city management. Its timeline graphic dates the request and the addition “Dec. 9, 2025” and “Dec. 11, 2025” and its text dates the voided check “January 4, 2024”; from the sequence, we read these as December 2024 and January 2025.

After disclosure

  • Inspector General: Found Accounts Payable had no procedure for verifying supplier contacts and strongly recommended a list of authorized users for each supplier account. Controls created after similar cases in 2020 and 2022 were not being used (Comptroller’s office leadership said they were not carried over to Workday). The Inspector General received the complaint about six days after the city learned of the fraud. Also called for staff training and rules requiring immediate reporting of suspected fraud. The matter was referred to law enforcement.
  • Accounts Payable: Now requires cross-verification with supplier contacts for all banking changes. From August 2025 in Workday: a restricted role for sensitive supplier-profile updates, email alerts to all listed supplier contacts on pending changes, a 48-hour delay with layered reviews for bank-account changes, and flags for rapid, duplicate or unusual profile activity. Talks are under way to add bank-account validation tools.

Why it wasn’t stopped

The failure was not a lack of approvals. Both the new contact and the bank change were approved, but no procedure required checking with the supplier’s registered contact.

The core of this case
The fake contact was added to the supplier's account without anyone checking with the supplier's registered contact. The bank change submitted from there passed two levels of approval.
Exhibit 2The gap between detection and proof

Proof here means checking with the supplier's registered contact that adding a contact and changing the bank account really came from that supplier, and keeping a record. Detection means noticing possible fraud after payment.

Proof layer · absentCheck contacts and bank changes with the supplier
Gap$1.52M to
another account
Detection layer · workedThe receiving bank flags possible fraud
STEP 1
12-11 fake contact added
STEP 2
02-19 bank switched
STEP 3
02-21, 03-10 payments
STEP 4
03-13 bank alert

The city learned of it from the receiving bank; the second payment came back, the first did not. Unless the check goes to the supplier’s registered contact, adding approvers does not stop an impostor. That distance is the gap between detection and proof, and it is structural.

The same structure appears in Polaris Holdings / Booking.com (a hotel’s payout account was switched in the legitimate admin screen).

How to counter this

Activate a new contact on a supplier account, and any bank change, only once confirmed with the supplier’s registered contact, never with the requester or a contact given in the request. Then using a supplier employee’s name is not enough to become a contact or change where money goes. It sits in front of detection, not in place of it.

Industries and operations to watch

IndustryPublic sector
Cities and public bodies with many suppliers. Supplier staff names are visible in public bids and contracts.
OperationAccount administration
Adding people to supplier portals, and what they can do there.
OperationBank account changes
Changes to a supplier’s bank account, and the documents backing them (voided checks, bank letters).

Do today’s controls close it?

ControlThis caseWhy
Multiple approversPartialTwo staff approved the bank change. Without a required check with the supplier, an impostor still passes.
Supporting documentsIneffectiveThe voided check was forged; both approvers said they did not recall seeing it. Documents can be forged.
Supplier self-service portalPartialSuppliers enter their own details, but anyone added as a contact also looks like the supplier.
Bank fraud detectionPartialThe second payment came back. The alert came too late for the first.
ControlsWhat is needed
  1. Treat adding a contact as seriously as a bank change. Check with the supplier’s registered contact before adding anyone to a supplier account.
  2. Activate a bank change only when confirmed with the supplier’s registered contact. Do not decide on a contact given in the request or on attached documents alone.
  3. Record who approved the change, and on what check. Tie it to the supplier’s list of authorized contacts and keep it as proof, so you can later show whose request was checked by whom.
CheckChecklist

Three things to confirm about supplier accounts

  • Do you have, for each supplier, a list of people allowed to change its record?
  • Do you check that the email address on a request to add a contact belongs to the supplier?
  • When a bank account changes, are all registered supplier contacts notified?

Note: if the supplier’s registered contact itself is compromised, this check can be passed. And it protects where payments go; false invoice contents still need separate controls.

Sources

  1. Primary, public synopsisCity of Baltimore, Office of the Inspector General “Public Synopsis of Case #25-0028-I: Fraudster Attempt to Divert $1.5Million of City Funds”2025-08-27 · s3.amazonaws.com/baltimorecity.gov.if-us-east-1/…
  2. Primary, response to the OIGCity of Baltimore, Comptroller’s Office, Accounts Payable “Agency Response to OIG Case #25-0028-I”2025-07-31 · s3.amazonaws.com/baltimorecity.gov.if-us-east-1/…
1 more (reporting, analysis)
  1. PressThe Record “Scammer steals $1.5 million from Baltimore by spoofing city vendor”2025-08-29 · therecord.media/scammer-steals-baltimore-city-impersonati…

References: “The last layer left in AI-era cyber defense”

The same method elsewhereSee all 7 "Payee & bank-account changes" cases Get new cases and checks like these by email

This material is a structured analysis of public information; it is not an audit, diagnosis, or recommendation for any specific organization.

Cite this Brief

Lemma Critical Team. (2026).
"City of Baltimore: A fake contact posing as a supplier's employee was added to the supplier's account, and its bank account was switched (city Inspector General report) — Nothing checks a new contact or a bank change with the supplier's registered contact".
Lemma Critical Brief No.160. Lemma / FRAME00, Inc.
https://lemma.frame00.com/critical/briefs/160-baltimore-workday-supplier-contact-bank-change/
Lemma

If it can't be verified,
it doesn't enter your operation.

Lemma attaches cryptographic proofs to data and AI execution, so the receiving side can confirm authenticity without asking the issuer. Detection stays; a proof layer is added in front of it.

Talk to enterprise See the verification center