The Federal Bureau of Investigation (FBI) and the Center for Internet Security (CIS) Cyber Threat Intelligence (CTI) team are publishing this product to provide updates to State, Local, Tribal, and Territorial government entities (SLTTs) about a scam in which threat actors masquerade as local and county planning and zoning departments to extract illegitimate land use application renewal payments from local businesses and residents. CIS CTI first reported this scam in the December 2025 advisory OCAR-2025-8 titled, “Nationwide Zoning and Planning Scam Targeting SLTT Residents.” In March 2026, the FBI released Public Service Announcement I- 030926-PSA titled, “Criminals Impersonating City and County Officials in Phishing Emails for Planning and Zoning Permits.”

Since this report, the FBI and CIS CTI have continued to observe widespread examples of this activity across the United States, including variations featuring several new shifts in tactics. Many SLTT entities have independently released advisories on this activity. Readers can identify these advisories by running a simple search engine query for “scam zoning and planning email.” SLTTs should consider disseminating messaging about this activity to their constituents and the companies with whom they have business, noting their official government email

domains for correspondence.

This OCAR is also available in the CIS Portal. Visit https://portal.cisecurity.org/cyber-threats for this and additional CTI products.

For questions about this report, please contact the CTI team at intel@cisecurity.org.

This information came from the FBI and MS-ISAC’s Operational Cyber Analytic Report (OCAR)