The city received instructions by email to change banking details for a service bill, but didn't suspect anything until hearing from the real vendor five days later.