Fraudsters across Marin County are targeting residents applying for building permits with convincing fake invoices, prompting FBI warnings about a nationwide scam that may be fueled by artificial intelligence.
The scheme came to light last summer when San Anselmo City Hall received an unexpected check. A resident had received an emailed bill claiming to be from the Planning Department and mailed payment, according to Heidi Scoble, San Anselmo’s development services director. The city had never issued the invoice.
«We’re looking at this thinking, ‘What is this?'» Scoble told SFGATE. Complaints soon poured in from residents across Mill Valley, Larkspur, Sausalito, Tiburon and Novato. A recent San Anselmo Planning Department meeting revealed the scam had spread countywide.
The operation follows a simple playbook. Scammers mine public records for permit applications, extracting addresses and case numbers from city portals. They locate applicants’ email addresses and send fake invoices demanding payment of permit fees through wire transfers, Zelle or cryptocurrency – methods government agencies never use, Scoble said.
The fraudulent emails appear legitimate, featuring correct property addresses, real case numbers, actual officials’ names, and government-style formatting and seals. The only tell-tale sign is a return address from domains like @usa.com instead of .gov. The messages create urgency and request email responses rather than phone calls to prevent victims from contacting real Planning Department numbers.
The FBI’s Internet Crime Complaint Center issued a public service announcement about the scheme on March 9. The scam operates nationwide, according to a January report from the American Planning Association documenting phishing emails in dozens of cities from Las Vegas and Houston to Minneapolis. Minneapolis Planning Director Meg McMahan told the association that residents in her city have received fraudulent emails since May.
Neither the FBI nor local authorities have disclosed total losses. San Francisco police reported in August that no financial losses had been identified locally, but the scale of the operation continues growing.
Security experts suspect artificial intelligence may be driving the sophisticated scams. Joseph Avanzato, security chief at Varonis, told SFGATE that the rise in high-quality phishing coincides with widespread generative AI adoption. Previous scam emails contained obvious errors and clumsy language, but current versions feature professional writing and accurate details. While the FBI bulletin doesn’t explicitly mention AI, it notes the emails’ «professional language, formatting, and level of detail.» Data breaches or automated parsing of public records could also explain the scammers’ access to information.
Bay Area jurisdictions have responded with warnings. San Francisco’s Planning Department posted a phishing alert banner on its website homepage. San Mateo County issued advisories about fraudsters creating fake websites that mimic the county’s permit portal.
Scoble compares fighting the scammers to playing Whac-A-Mole. Attacks subsided over the summer but returned recently. This week another San Anselmo resident received a fake invoice and called angrily, believing the city had overcharged him. «We’re an easy target,» Scoble acknowledged. Permit fees already frustrate residents, giving scammers an opening to exploit.
Bay Area permit applicants should follow three rules to avoid the scam. Cities never request payment through wire transfers, Venmo or cryptocurrency. Email addresses must use .gov domains – any other domain should raise suspicion. When in doubt, call the Planning Department using numbers from official websites rather than contact information in emails.
