The FBI's Milwaukee office says sophisticated email scams aimed at local governments, nonprofits and churches are on the rise. The messages are built to look routine: a trusted name, a payment request, and an address altered just enough to survive a quick look.
Organizations should examine email addresses carefully and independently verify unexpected financial requests before transferring money.
A Pastor's Name on the Wrong Account
Business email compromise is a narrow kind of fraud. Criminals use deceptive emails to trick an organization into sending money. They impersonate trusted contacts and build addresses that closely resemble real ones, changing small details so the message looks authentic.
Carr said the alterations are slight. They are supposed to be. The change is built for a glance: someone who recognizes the sender's name is not meant to retype the domain, especially when the ask is a transfer the organization already knows how to make.
A church employee responsible for finances may receive what appears to be an email from the pastor requesting a transfer. In a separate fraud pattern, a message may provide banking instructions and ask for a change in payment. In the pastor-impersonation pattern, the relationship is familiar; the destination account may not be.
Anyone who receives a suspicious email should verify the request by phone. The FBI's published guidance adds a rule about which phone to use. Do not click through the message, and do not dial a number a potential scammer supplied. Look one up independently and ask whether the request is legitimate, the bureau says on its business email compromise page.
How a .US Domain Moved City Money
Milwaukee has already had a version of that request clear an internal desk. Internal records reported by WISN in September 2025 show city staff changed a construction vendor's direct-deposit information after an email impersonating Scherrer Construction. The records indicate the $460,866 payment was made July 15.
The fraudulent message used a scherrerconstruction.us address. Scherrer Construction, WISN reported, has only .com email addresses. No invented company name was required. A different domain ending was enough to send a real vendor payment to a fraudulent account.
A second document in the file did not hold up, and it did not hold up in time. On Aug. 4, more than a month after the account information had been changed, a Milwaukee Public Library staff member wrote, "This concerns me that the Bank Verification Letter is not legitimate."
Capital One held the payment and did not disburse it to the scammer. The city later recovered the funds. Roedel told WISN 12 News, "Bill applied for retrieval of the funds and then we received the funds back."
The near-miss produced a checklist. The city said it had already put in place stronger internal controls, enhanced verification procedures and additional staff training. Those procedures include verifying an account-change request by phone with a trusted contact and checking prior bank account information. The city added those procedures after the payment had already gone out.
A School Loss and a Partial Return
Milwaukee Public Schools reported a separate bank-impersonation fraud by someone outside the district. The initial loss was approximately $450,000, WISN reported. The fraudster, as the district described the case, was not an insider rewriting a payment from within the system.
U.S. Bank recovered $255,000. The district was working with the bank to recover the remaining $195,000. Capital One had stopped the city's Scherrer payment before disbursing it to the scammer. The school figures describe an initial loss, a partial recovery, and an effort to get the rest back.
The disguises were different. City staff acted on an email pretending to be a construction company the city already paid. The school loss, as the district described it, came from someone impersonating a bank. Both turned on an outside instruction treated as a reason to move the institution's money.
Letters, QR Codes and Permit Bills
Email is not the only stationery in use. The Wisconsin Better Business Bureau says scammers are sending businesses official-looking letters that impersonate government agencies and seek money or personal information, WisBusiness reported. The bureau described scammers targeting business owners and confusing them into giving up information.
The letters may falsely demand business-ownership filings and send recipients to a website or a QR code, sometimes with a threat of fines for noncompliance. The bureau's advice matches the phone rule on the FBI's scam page: call the government office directly, using the official number, and ask if the notice is real. A letterhead and a deadline are not that call.
On March 9, 2026, the FBI warned of an emerging phishing scheme pointed the other direction. Criminals were impersonating city and county officials and soliciting fraudulent payments for planning and zoning permits, according to a notice on the bureau's Internet Crime Complaint Center site. A fake permit bill and a fake vendor email are the same redirect, aimed at opposite sides of the counter.
National complaint figures put business email compromise near the top of reported losses. In the FBI's 2025 Internet Crime Complaint Center report, investment-related fraud was again the largest component of reported losses, followed by business email compromises and tech-support scams. Friday's Milwaukee warning described an increase in sophisticated versions of that scheme, aimed at local governments, nonprofits and churches.
Use a Number the Email Did Not Supply
What Friday's warning adds for a church, a nonprofit or a city office is a sequence, not a new piece of software. Read the address down to the domain. If the request is unexpected, leave the message and call a number already on file, or call the bank. The FBI's page is explicit that the number in the email does not count.
Milwaukee's Scherrer payment is the local measure of skipping that sequence. The fraudulent .us address was still effective when $460,866 went out on July 15. The doubt a library staff member wrote down on Aug. 4 arrived after the account change and after the payment. Recovery followed a bank hold and a retrieval request. It did not precede them.
Carr's example leaves the next move with the person who opens the message. A church employee responsible for the money may see the pastor's name and a set of banking instructions in the same note. The warning from the Milwaukee office is that those two things, sitting together in one email, are a reason to stop, not a reason to send.
