Public Service Alert: A New AI Driven Scam Targeting Permit Applicants

At GeoCivix, we work closely with cities, counties, towns, and special districts across the country. Over the past several months, we have heard the same deeply concerning story from multiple jurisdictions and their applicants. Permit applicants are being scammed out of real money through highly sophisticated, targeted email attacks that convincingly appear to come directly from local government.

This is not a theoretical risk. It is happening now, and it is accelerating.

What GeoCivix Is Seeing

We have recently become aware of a disturbing new trend in which scammers are using artificial intelligence to systematically gather publicly available information from government websites and public meetings.

This includes:

• City, county, and town websites
• Planning commission agendas and minutes
• Staff reports and published documents
• Video recordings of public meetings that are transcribed
• Project names, addresses, and approval status
• Names and titles of real directors, officers, and staff assigned to a project

Using AI tools, attackers can scan, read, summarize, and correlate this information at scale. The result is a highly detailed profile of an active project and the people involved in it.

 That information is then used to launch extremely convincing targeted attacks.

A Note on Data Sources and Platform Security

It is important to be clear that the information being used to perpetrate these attacks did not originate from the GeoCivix platform, nor is it the result of any breach of our systems. The data being exploited is publicly accessible information published as part of transparent government processes.

 Even so, we believe it is critically important to speak up. This trend affects the entire public sector ecosystem, and remaining silent would be a disservice to the jurisdictions we serve and the applicants they support. As a technology provider deeply embedded in permitting and development workflows, we feel a responsibility to raise awareness, share what we are seeing across multiple agencies, and help prevent further harm through education and proactive guidance.

What Is a Spear Phishing Attack?

A spear phishing attack is a highly targeted form of phishing. Unlike generic scam emails that are easy to spot, spear phishing attacks are customized for a specific individual, project, or organization.

In the cases being reported, applicants receive emails that:

• Appear to be sent from the local jurisdiction
• Reference the real project name and address
• Indicate that the project has been approved or cleared for the next step
• Use accurate language consistent with permitting workflows
• Include the name and signature of a real director or officer
• Instruct the recipient to follow payment or wire transfer instructions

Because the information is detailed and accurate, these messages are understandably trusted.

By the time the fraud is discovered, the funds are often unrecoverable.

Why This Is So Dangerous

What makes this trend especially concerning is that it exploits transparency.

Public meetings, published agendas, and open records exist to serve the public good. AI now makes it possible for bad actors to weaponize that transparency at scale, rapidly converting public information into tools for fraud.

These attacks do not require system breaches or internal access. They rely entirely on publicly available data combined with AI driven analysis and automation.

Our Recommendations for Jurisdictions

Based on what we are seeing across the industry, we strongly recommend the following steps:

1. Proactively warn applicants
Clearly state on your website, application portals, and official communications that your jurisdiction will never request payment via wire transfer or ask applicants to follow payment instructions from unsolicited emails.

2. Standardize payment workflows
Require that all fees be paid only through a clearly defined, secure payment portal. Eliminate ambiguity around where and how payments are made.

3. Use consistent sender addresses
Ensure that all official communications originate from known, consistent email domains and addresses, and encourage applicants to verify the sender carefully.

4. Educate staff and boards
Make staff members, inspectors, and board participants aware that their names and signatures may be impersonated so they can help reinforce warnings when communicating with the public.

5. Encourage verification
Advise applicants to verify any payment request by logging into the official system or contacting the jurisdiction directly before sending funds.

Our Recommendations for Applicants

If you are an applicant, contractor, designer, or developer:

• Be cautious of emails requesting payment outside of a known portal
• Do not trust payment instructions delivered by email alone
• Verify requests through the official permitting system or direct contact
• Report suspicious messages to the jurisdiction immediately

Our Commitment

At GeoCivix, security and trust are foundational to how we design and operate our platform. This issue deserves broad awareness and proactive education across the industry.

This article is intended as a public service alert. We encourage jurisdictions to share this warning with applicants, partners, and stakeholders.

Transparency should not come at the cost of public trust. Awareness and verification are critical steps in stopping these attacks.