Fraudsters are Posing as City Employees and Demanding Payment to Get Applications Approved

Wednesday, November 4, 2026 — Cleveland — The City of Cleveland is warning residents, homeowners, landlords, business owners, title companies, and other community members following an uptick in recent weeks of a new scam targeting those who have recently submitted applications to the City for review and users of other City services.  The scam has been linked to various services including building/construction permits, certificates of disclosure, rental registrations, lead safe certificates, and civil tickets.  The scammers mention administrative costs and that payment is needed to approve an application or settle a fee – usually requesting to be paid through a wire transfer.  The fraudsters typically reach out via email and often times include a fake invoice attachment.  The scam seems realistic on its face as they include accurate descriptions of actual projects that applicants have submitted, like the installation of a new garage or replacement of a roof.  In most instances, the scammers are also pretending to be individual City employees or trying to mimic department-wide City email addresses.  All fraudulent attempts so far have come from email addresses ending in “@usa.com”.

The Department of Building & Housing, Office of Information Technology & Services, Law Department, and City Planning Commission opened an investigation upon learning of the situation.  The City took quick, decisive action to identify potential sources that may have enabled the scam.  That assessment determined the likely culprit was customers’ email addresses and phone numbers being displayed on the Permit Portal, which is hosted by the City’s vendor.  This meant that fraudsters were able to look up legitimate permits tied to real projects and pull applicants’ contact information, which they then used in a deceit attempt to obtain fraudulent payment.  It’s important to note that individuals’ phone numbers and email addresses tied to permits, inspection records, and civil tickets were not posted on the City’s Open Data portal.

The City contacted the vendor that hosts the Permit Portal to discuss actions they could take and ultimately instructed them to turn off certain features.  The contact information has since been removed from the site.  The City discussed the scam with cities who are facing similar issues and will continue to explore other options to effectively balance openness/transparency concerns with limiting information that can be exploited by scammers.

At this point, there aren’t any known victims as no one has reported paying the scammers, nor has any confidential information been compromised (social security numbers, bank accounts, etc.).  The matter was also referred to law enforcement for further investigation and the City will continue to monitor.

During the initial wave of fraud attempts, the City took various measures to increase awareness of the scam that included direct outreach to individuals who applied for construction permits, posting signage in City Hall alerting people as they interact with respective departments, as well as updating both the City’s main homepage and permit portal with fraud alert banners.  Given an uptick in occurrences, the City is now rolling out a more comprehensive campaign and additional education efforts to increase awareness and further inform the community about the scam – including social media posts and voice broadcasts in the coming days.  The City is also collaborating with the County’s Scam Squad to amplify messaging through their channels, since scammers have targeted individuals and companies in other suburbs who do business in Cleveland.

The City is encouraging those who submit applications to:

• Always Verify Legitimacy of Payment Requests – 
  • Log into your account on the City’s Permit Portal to verify the status of any outstanding payments
• Use Authorized Payment Methods – 
  • Credit cards or bank payments can be made securely through the City’s Permit Portal.
  • Payment can also be made by cash or check in-person during normal business hours at City Hall (601 Lakeside Ave., Cleveland, OH 44114)
  • The City will NEVER ask for a wire transfer
• Know Official Communication Channels – 
  • Always make sure to double-check email addresses
    • Official Permit Portal emails come from Auto_Sender@mail.permitcleveland.org, and official payment receipts come from customerservice@acipayonline.com
  • Do NOT open attachments from unknown senders, click suspicious links, or share account numbers with unknown sources.
• Report All Suspicious Occurrences – 
  • If you have been targeted by this scam, or receive one of these emails in the future, please report it to phishing@clevelandohio.gov
• Exercise Caution Before Acting – 
  • You can always reach out to the City directly with questions or to confirm the validity of a payment request by calling 311.  Citizen Support Specialists will assist the best they can or transfer you to the appropriate department.

See below examples for side-by-side comparisons of legitimate communication vs. scam attempts.

CYBERSECURITY AWARENESS MONTH
As the world becomes increasingly digital, opportunities for fraud continue to grow.  Although Cybersecurity Awareness Month just ended, the City is reminding everyone to remain vigilant when receiving emails requesting payments, personal account numbers, or other sensitive information. Fraudulent emails can be crafted in ways to look like they’re from government agencies, financial institutions, businesses, or other trusted organizations.
 

Be on the lookout for the following warning signs that may indicate potential email scams:

• Aggressive or threatening language demanding quick payment, paying extra for an expedited service, requesting all correspondence to be conducted exclusively via email, etc.
• Asking for extreme amounts of money related to unexpected fees / unverified services
• Sending wire instructions or requesting payment through a separate, unauthorized third-party website that may be difficult to trace
• Suspicious sender addresses or unusual domains that may contain extra characters, misspellings, or subtle variations of legitimate addresses to imitate government officials or other trusted sources
• Poorly reproduced logos that appear distorted, pixelated, or inconsistent with an organization’s usual branding
• An abundance of typos, spelling errors, grammatical mistakes, etc.

The Cybersecurity and Infrastructure Agency (CISA) offers additional guidance, resources, and tips to recognize and report phishing on their website.