LYNNWOOD — A phishing scheme in 2024 led the City of Lynnwood to deposit $7,158 in payroll funds into a fraudulent bank account, exposing gaps in the city’s internal controls over electronic payments, according to a management letter from the Washington State Auditor’s Office.
The letter dated October 20, 2025, summarized issues identified during the accountability audit covering January 1 through December 31, 2024. The matters were not elevated to formal findings in the public audit report but were deemed significant enough to require attention from city management and the City Council. The letter was referenced in the audit report and is a public record.
Auditors found the city lacked adequate internal controls to protect public funds from internal and external threats involving electronic payments. The city reported the phishing incident in 2025. It involved a payroll payment redirected after a fraudulent request that appeared to change an employee’s bank account information.
Since 2016, Washington local governments have reported more than $37 million in losses from cyberfraud schemes including phishing, spearphishing and business email compromises. In these schemes, external actors contact government staff while posing as known employees, managers, vendors or associates, then convince them to redirect legitimate payments or purchase gift cards…