State and local government contracts are very often subject to sunshine laws and if they aren't publicly posted available via public records request, as are many internal documents of on-paper internal procedures as well as many documents from which in-reality procedures, to the extent they differ, can be inferred.

They will lead with a spoofed email from utilities commissioner to comptroller: “We’re bringing Acme Co. on as contractor for the sewers project, their W9 and banking details are attached.”

Business email compromise scammers have improved and are no longer just spamming with obvious gift-card schemes in broken English.