Lexington, Ky., loses $4M in housing assistance to email scheme

Officials in Lexington, Kentucky, said Monday that the city lost about $4 million in federal housing assistance funds to an email fraud scheme.

The theft, which is now being investigated by the Lexington Police Department’s financial crimes unit, included three wire transfers of funds for emergency rental assistance and transitional housing to a private bank account. The transfers were made, officials said, when a malicious actor impersonated an email account belonging to Community Action Council, a local housing group that works with the city.

Community Action Council notified city officials Sunday that it never received the rental assistance money, according to a press release.

Lexington officials said no one from the municipal government or Community Action Council appears to have been involved in the scam, and that the phony account’s bank froze the funds upon being notified of the theft. The city’s financial system was not compromised by the theft either.

Created in a late 2020 appropriations package and replenished by last year’s American Rescue Plan, the federal government’s emergency rental assistance program has sent nearly $23 million to Lexington. An initial $9.6 million tranche the city received directly from the U.S. Treasury is set to expire Sept. 30, while the remainder, allotted to Louisville out of the $264 million Kentucky’s received from the program, runs out in September 2025.

While not as high-profile as other attacks, business email compromise schemes continue to account for more financial losses than all other cyberthreats. According to the FBI’s Internet Crime Complaint Center, BEC scams caused nearly $2.4 billion in losses last year