What happened
On 29 April 2026 a City of Aurora, Illinois employee took a call from someone posing as a representative of the city's bank and disclosed sensitive banking information. The caller used those details to make fraudulent transactions totalling nearly $1.1 million from municipal accounts. Officials found no evidence that city networks or data systems were compromised. Law enforcement, the bank and outside cybersecurity experts were engaged, and the city holds insurance for losses of this kind.
How the deception worked
The pretext was routine banking business and the identity impersonated was the city's own financial institution, the party a finance employee expects to hear from about account matters. Officials described these schemes as exploiting trust and manufacturing urgency, and the deception worked purely by phone; nothing was hacked. The employee supplied account credentials or verification details during the call, which the fraudster immediately used to authorise transfers out of city payroll accounts. Discovery came shortly after the payments cleared.
The control that would have caught it· our reading, not a claim from the sources
A hard rule that no banking detail or verification code is ever given on an inbound call, only on a callback to a number held on file, plus bank-side dual authorisation on outbound transfers.
Sources (2)
- Aurora lost nearly $1.1M from city bank accounts after employee fell for phone scam, officials sayNBC Chicago·nbcchicago.comOpen ↗
- 'Social Engineering Fraud' Cost Aurora, Ill., Nearly $1.1MGovernment Technology·govtech.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.