Portland nearly lost $6.7M on a Bull Run payment after someone posed as MWH’s John Lisman

Portland nearly lost about $6.7 million on a Bull Run filtration payment after someone posing as MWH senior proposal manager John Lisman rewrote the MWH–Kiewit joint venture’s vendor bank details. In February 2025 the city rolled out SAP Ariba for those vendors. Soon after, the imposter asked accounts payable to change bank details and sent account paperwork, including a Truist confirmation letter.

Staff challenged the address on file; it went unanswered, so they held. The imposter kept pushing, then asked the city to resend an Ariba password-reset link to what looked like the same address. The link didn’t reach the real Lisman. It let the thief rewrite the joint venture’s vendor profile and add a Chase account. On March 21 the city initiated about $6.7 million toward that account. When the imposter tried yet another last-minute account swap, Chase flagged Wells Fargo. Portland’s treasurer moved fast to block the remittance. The Chase account sat with a New York law firm that turned out to be a victim too — not a co-conspirator. U.S. Marshals took custody; the city later recovered the funds. The crook posing as Lisman even called accounts payable ten times asking where the money was.

A password-reset email is not a payment approval. If a vendor “can’t get into the system,” call the person you already know.

If you want a plain read on whether strangers can email as your company — spoofcoach.com. Free.