What happened
The Portland Housing Bureau funds affordable housing in Oregon's largest city. In spring 2022 the nonprofit Central City Concern was about to request a $1.4 million construction draw for its Starlight housing project. Someone else got there first. On 25 April 2022 the city wired about $1.4 million to an account that was not the nonprofit's.
On 17 May a second attempt from the same source was flagged. On 27 May the city announced that an outside party had gained access to a City email account and diverted the money. It opened a cybersecurity investigation.
In April 2024 a 39-year-old woman, Chantail Williams, was arraigned on seven counts, including aggravated theft, aggravated identity theft, computer crime and money laundering. KPTV reported that the money had been wired to a Florida account of a company she managed. The charges are allegations unless a court finds otherwise.
The email
OPB reconstructed the case from public records. The outside party controlled a Housing Bureau employee's mailbox, likely after the employee was phished. From that position the impostor could read the bureau's real correspondence and time the request. Posing as an official of Central City Concern, they sent payment instructions for an account whose name did not match the nonprofit's.
Why it worked
The city did notice a problem. OPB reported that the city treasurer, Brigid O'Callaghan, saw that the name on the receiving account did not match Central City Concern's. She wrote that this is often a red flag that payment instructions are fraudulent. Two officials who handled the bureau's finances then confirmed to her that the banking details were correct. Emails show that a bureau official had been in contact that day with someone posing as the nonprofit's treasury manager, with the nonprofit's logo in his signature. The city later said the confirmation had come from the impostor, not from its partner. The payment was sent.
That is the core of the case. A check that goes back through the channel the attacker controls confirms nothing. When the attacker sits inside a real mailbox, replies come from real addresses, and every answer sounds right.
What it cost
The city put the loss at about $1.4 million from its General Fund. The city repaid Central City Concern for the draw it was owed, and OPB reported that it expected to recoup about $500,000 from cyber insurance.
What would have helped
The treasurer's instinct was right. What failed was the follow-up. A mismatch like this calls for a phone call to the nonprofit, on a number from the city's own records, before any money moves. A rule that a flagged payment stays on hold until that call happens would have turned the warning into a stop.
Inside the city, stronger sign-in protection for staff mailboxes and alerts on unusual mailbox activity make it harder for an outsider to sit in a real account for weeks.
What a warning inside the message would have shown. Antilure marks wording that asks to change payment details and explains the sender in its Details panel. It also flags a message whose replies go to a different domain from the one it was sent from. When a request comes from a genuine mailbox, the wording carries the warning.
Sources
- City of Portland identifies fraudulent financial transaction, launches cybersecurity investigation, City of Portland, 27 May 2022, updated 1 June 2022.
- Before Portland lost $1.4 million in cyber breach, city treasurer raised red flag, Rebecca Ellis, OPB, 22 August 2022.
- Woman arraigned on theft and money laundering from City of Portland, KPTV, 4 April 2024.