What happened
Scherrer Construction was working on a Milwaukee Public Library project. In June 2025 the city received an email that appeared to come from Scherrer's accounting department, asking to change the company's bank account. Forged documents followed on 2 July, with a verification letter dated 27 June. On 15 July the city paid $460,866 to the new account.
The fraud came out when real Scherrer staff asked about a delayed payment, in an email of 4 August. Capital One, which held the receiving account, had not released the funds to the fraudster. Milwaukee police recovered the payment about three weeks after the fraud was discovered. The city's comptroller announced the recovery on 2 September 2025 and said police believed the suspects were overseas.
The email
WISN 12 reviewed the city's internal records. They show the request was handled by library staff. The library's construction projects manager wrote that the inquiry came from an address at scherrerconstruction.us, a domain the company does not use, and that Scherrer has only .com addresses.
The comptroller, Bill Christianson, told FOX6 that the email had the company's signature and logo, with one key change to its email address. WISN quoted the city describing the message as designed to appear almost exactly like a legitimate email from the vendor.
Why it worked
Changing only the ending of a domain is one of the cheapest disguises there is. The company's name is intact. The signature and logo are copied from a real email. On a phone, or in a mail client that shows the display name first, the address may not be visible at all. A reader who checks the name sees the right company.
The forged documents did the rest. A bank change backed by a signed form and a verification letter looks more official than the original relationship. WISN's headline speaks of red flags. The records it cites show that the difference in the domain was there to be seen.
What it cost
Nothing in the end. The money stayed in the receiving bank and came back. That outcome depended on the bank holding the transfer and on the real contractor asking about its payment within weeks. Milwaukee police's financial crimes unit and the FBI worked the case.
What would have helped
A call to Scherrer on a number from the city's own contract records, before the first payment to new details. A rule that a change request from a new address never goes through on paperwork alone closes this route.
What a warning inside the message would have shown. A domain that matches a known one except for its ending is the pattern Antilure's lookalike check is built for. Its Details panel explains the sender, and its marks label wording that asks to change payment details. The banner on such a message says: don't reply or pay, check with the sender another way. The domain is on record: scherrerconstruction.us, where the company uses scherrerconstruction.com.
Sources
- Milwaukee recovers nearly $461K after fraud scheme targets city vendor, FOX6 Milwaukee, 2 September 2025.
- Milwaukee police recover $460,866 payment made by city to scammers, Tanner Kahler, WISN 12, 2 September 2025.
- Despite red flags, city almost sent $460K to scammer; internal records explain how, Derrick Rose, WISN 12, 5 September 2025.