City of Mercer Island Lost Over $420,000 to Cyberfraud Scheme

The Office of the Washington State Auditor has released an Accountability Audit Report detailing a severe breakdown in internal controls that cost the City of Mercer Island hundreds of thousands of dollars in public funds.

According to the report published in February, the city lacked adequate internal controls over vendor payments during the 2024 fiscal year. This deficiency culminated in a single, misdirected payment of $420,351, which was mailed to a fraudulent vendor address following a phishing incident.

At the center of the issue was a fundamental lack of formalized verification protocols. The state auditor found that the city operated without a policy requiring sufficient verification for requests to change vendor information, which is necessary to ensure the actual vendor made the request.

While the city had informal expected procedures in place, investigators found that these expectations did not include specific verification procedures, and staff did not consistently follow them.

Furthermore, the city did not require staff to direct payment or address change requests through a centralized department or position, a step that would better ensure consistent and sufficient verification.

A Costly Lack of Resources

The auditor’s office was blunt regarding the root cause of the vulnerability. The report states that city management “did not dedicate the necessary resources to adequately respond to this emerging fraud threat.”

The stakes for the municipality were high. The city spent about $63.8 million in vendor payments in fiscal year 2024, making the establishment of effective controls critical to protecting payments from internal and external threats.

Recovery and Corrective Actions

The city reported the phishing incident and misappropriation of public funds to the auditor’s office in 2025. Upon discovering the fraud, the city immediately notified the Mercer Island Police Department, the city’s banking institutions, and the State Auditor’s Office.

According to the city’s official response included in the audit, the police criminal investigation remains open and ongoing. To date, the city has successfully recovered $370,351 of the stolen $420,351.

In the wake of the loss, Mercer Island management engaged external consultants to independently review the city’s accounts payable disbursement policies and control environment. Immediate actions were taken to implement a centralized review and approval of all vendor changes.

The auditor’s office noted they will review the status of the city’s corrective actions during their next audit.