Fraud alert: fake 'compliance' emails from @mmo-sc.us target South Carolina state suppliers

South Carolina's Division of Procurement Services issued a fraud alert on Oct. 30, 2026. It warns that people are impersonating state procurement staff in emails to suppliers.

What the emails look like

According to the division, the emails request payments for alleged vendor compliance violations, "remediation deposits" or other made-up state requirements. The sender addresses closely copy real staff addresses, but the domain, @mmo-sc.us, is not a South Carolina government domain. The division's own addresses use mmo.sc.gov.

The division says the emails may include:

• official-looking documents, including a form styled as a vendor compliance exception notice;
• state agency references, contract numbers and vendor information;
• threats of payment delays, suspension of vendor status or loss of future contracting opportunities.

"These payment requests are fraudulent. Do not send payment," the alert says.

What to do

The division advises suppliers to:

• not send payment in response to unsolicited compliance or remediation requests;
• not click links, open unexpected attachments, or give banking or financial information;
• verify questionable requests directly with the division, using contact information from the official state website;
• not rely on the sender's name, email signature or official-looking documents as proof;
• report suspicious emails to VendorSupport@mmo.sc.gov.

Anyone who has already paid or shared financial information should contact their bank immediately and notify the division.

Why now

The alert lands while vendor registration is frozen for the move to the new SCPro portal, which goes live Nov. 9. Scammers often exploit system changes, when suppliers expect unusual requests. No legitimate part of the SCPro transition asks suppliers to pay a fee by email.

Contractors and subs who sell to the state should share the warning with their accounts-payable and office staff.

How to check a request

A few habits stop most of these attempts before money moves:

• Read the domain, not the display name. The fake addresses copy real staff names. Only the part after the @ gives them away: mmo-sc.us instead of mmo.sc.gov.
• Call back on a number you already have. The division's advice is to verify using contact information from the official state website, not from the email or its attachments.
• Treat a deadline plus a threat as a warning sign. The division says the emails may threaten payment delays, suspension of vendor status or loss of future work.
• Lock down payment changes. A common internal control is to require a second person to approve any request to change bank details or pay an unfamiliar "deposit."

How state registration actually works

Under SCPro, which replaces the old vendor portal on Nov. 9, suppliers manage their own profiles. Only the Supplier Finance role can manage bank details, and bank information is entered through a secure external link from within SCPro, according to the division's FAQ. The division's transition materials point suppliers to webinars, quick reference guides and an FAQ, all on procurement.sc.gov.

The division has posted examples of a fraudulent request and a fraudulent form on its alert page so suppliers can compare what they receive.

Not just a state problem

The same impersonation tactic shows up wherever suppliers expect official requests. A spoofed domain one character or one dash away from the real one, an invoice-style form and a deadline are all common. Construction firms get similar emails pretending to be general contractors asking to change remittance details. The defense is the same: verify through a number or portal you already trust before changing any payment instructions.

Key dates

The alert is dated Oct. 30, 2026. Vendor registration is frozen from Oct. 26 until SCPro goes live on Nov. 9. Suspicious emails should be reported to VendorSupport@mmo.sc.gov.

Our SCBO and SCPro guide explains where South Carolina advertises state solicitations and how the new registration levels work.