Ratepayers in Londonderry could have been left with a £100,000 bill after the city council was fooled into paying the money into a fake bank account.
One councillor asked whether the local authority was now on a "suckers' list" of targets for fraud.
The scam came to light when a contractor contacted the council to find out why he had been sent a remittance for the payment - which never arrived in his account.
It emerged that a letter claiming to be from the contractor was sent to the former Derry City Council in February informing staff of a change in bank details. This was accepted without question as legitimate.
Then £99,426.24 was transferred into the bogus account.
The scam came to light a few days later when the real contractor contacted the council and asked where the money had gone.
Alarm bells rang immediately and the bank and police were contacted. The fraudulent account was frozen, and the money was recovered and returned to the council last month.
The attempted fraud emerged this week during an assurance risk committee meeting, although councillors had been aware of it since February.
Councillor John Boyle said it raised questions about whether ratepayers would have been left to pick up the £100,000 bill if the contractor had not contacted the council in time.
He said: "I suppose we have to be grateful that the mistake was realised in time to stop the payment. But this was thanks to the contractor contacting the council asking questions about why the money was not in his account.
"This was done in time for the money to be stopped - but you have to wonder what would have happened if the contractor hadn't queried it.
"Swift action was taken and I have been assured that new procedures have been put in place to make sure it doesn't happen again. Clearly the procedures that were in place were not adequate to prevent this happening in the first place.
"We heard this week about a so-called 'suckers' list' of people who have been duped by fraudsters and scam artists who are employing ever more sophisticated methods to con people, and you have to wonder if the council is on that list now.
"There is a lesson in this for all business, and indeed all of us as individuals, to be ever vigilant and never accept a call, email or letter asking for money at face value, no matter how legitimate it appears to be."
A spokeswoman for Derry City and Strabane District Council said more stringent procedures were now in place to prevent a repeat of this kind of mistake.
She said: "Thanks to swift action on the part of both the bank and council staff no financial loss was incurred.
"Council reported the incident to PSNI."