Permit-fee Scammers Use 53 Verified Mule Accounts in One Campaign, Researchers Say
Summary
CYBERA says it traced a permit-fee impersonation ring to 53 verified US mule accounts across 23 email campaigns. The scammers target property owners using public records and seek payment by wire or other fast-moving payment rails.
Key points
- The FBI warned that criminals are impersonating city and county planning departments to demand fake permit fees from property owners with active applications.
- Scammers use public permit records, real property details, official-looking invoices and short deadlines to pressure victims into sending payments.
- CYBERA says it monitored one operation, dubbed Diligent Planner, from September 2025 and identified 53 verified mule accounts across 23 email campaigns.
- About 55% of the identified accounts were concentrated at two beneficiary banks, according to CYBERA.
- Researchers linked the operation’s accounts, emails, phone numbers and impersonated government bodies into a connected cluster.
- CYBERA observed the ring shifting toward smaller regional institutions and away from wires toward instant peer-to-peer payments.
- The article recommends that financial institutions screen outbound payments, new beneficiaries and account-change requests against verified mule-account intelligence.
Article Details
- Event Type
- Government-impersonation scam involving fraudulent city and county planning and zoning permit-fee invoices, with victims pressured to send wire, peer-to-peer, or cryptocurrency payments to money-mule accounts.
- Impact
- The FBI reported roughly $798 million in losses for government-impersonation schemes in 2025, nearly double the prior year; this figure is for the broader category, not this specific scam. CYBERA reported that one monitored ring used 53 verified mule accounts across 23 email campaigns, with roughly 55% of the accounts concentrated at two beneficiary banks.
People
Vendors
CYBERAResearch from CYBERA, the partner behind Recorded Future® Money Mule Intelligence, maps a single active ring down to the verified accounts it used, and shows why direct, fraudster engagement and account-levelRecorded FutureMoney Mule Intelligence is an add-on capability to Recorded Future that provides verified intelligence on the bank accounts actively being used to cash out scammed funds.
Products
Money Mule IntelligenceResearch from CYBERA, the partner behind Recorded Future® Money Mule Intelligence, maps a single active ring down to the verified accounts it used, and shows why direct, fraudster engagement and account-levelPayment FraudLike Recorded Future’s Payment Fraud solution, these confirmed lists enable financial institutions to act on external signals that behavioral monitoring alone can miss.