Analyzes business email compromise (BEC) scams where attackers impersonate executives or vendors to trick employees into transferring funds or sharing sensitive data. Covers detection methods, employee training approaches, and technical controls to prevent BEC attacks.
posts
Two Trusted Brands, One Devastating Scam In late 2024, security researchers at Avanan documented a surge in phishing campaigns that combined PayPal and DocuSign branding in a single attack chain. The attackers sent emails that appeared to come from DocuSign, notifying the recipient of a payment document waiting for their
The CEO Who Wired $47 Million to a Stranger In 2016, FACC, an Austrian aerospace parts manufacturer, lost €42 million (roughly $47 million) after a threat actor impersonated the company's CEO via email and instructed an employee to wire funds for a fake acquisition project. The CEO and
A Single FakeEmail Cost This Company $37 Million In 2024, the FBI's Internet Crime Complaint Center reported that business email compromise — attacks built on fakeemail messages that impersonate trusted senders — generated over $2.9 billion in adjusted losses. That made BEC the costliest cybercrime category for the fourth
In 2019, a Lithuanian man named Evaldas Rimasauskas pleaded guilty to stealing over $100 million from Google and Facebook — using nothing more than a series of fake email messages. He impersonated a legitimate hardware vendor, sent invoices from spoofed email addresses, and two of the most sophisticated tech companies on
In 2023, the FBI's Internet Crime Complaint Center reported that business email compromise — a category built almost entirely on the fake email — cost victims over $2.9 billion. That wasn't from sophisticated zero-day exploits. It was from emails that looked real but weren't. I&
A Single Email Cost This Company $37 Million In 2016, FACC, an Austrian aerospace parts manufacturer, lost €42 million (roughly $47 million at the time) after attackers impersonated the CEO and convinced a finance employee to wire funds to accounts controlled by threat actors. The employee believed they were following
In 2023, a finance employee at a multinational firm wired $25 million after receiving what appeared to be emails from the company's CFO. The messages were convincing, urgent, and completely fabricated. The attacker used a fake mailer — a tool designed to forge the "From" field in
The $55 Million Email That Fooled a CFO In 2024, the automotive parts manufacturer Scoular lost $17.2 million to a business email compromise scheme. But that wasn't even close to the record. Ubiquiti Networks lost $46.7 million. Austrian aerospace firm FACC lost $55.8 million — and
The Phishing Email That Came From PayPal's Own Servers In late 2024, security researchers at Avanan documented a campaign where threat actors sent phishing invoices through PayPal's actual invoicing system — meaning the emails passed SPF, DKIM, and DMARC checks flawlessly. The same tactic has since merged
A Single Email Cost This Company $47 Million In 2016, Austrian aerospace firm FACC lost €42 million (roughly $47 million USD) after threat actors impersonated the CEO in a carefully crafted email to the finance department. The employee who wired the money believed they were following a direct executive order.
