{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2014-scoular-company-wires-17-2-million-after-fake-ceo-and-auditor-emails"},"incident":{"title":"Scoular Company wires $17.2 million after fake CEO and auditor emails","date":"2014-06","date_precision":"month","victim_org":"The Scoular Company","sector":"Other","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":["Vendor / Supply Chain Impersonation"],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":17200000,"loss_note":"$17.2 million sent in three transfers of about $780,000, $7 million and $9.4 million to a bank in China.","records_affected":null,"threat_actor":null,"summary":"In June 2014 the corporate controller of Omaha-based commodities trading firm The Scoular Company wired $17.2 million to a Chinese bank in three installments after receiving emails impersonating chief executive Chuck Elsea and the company's outside auditor at KPMG. The messages described a confidential international acquisition and demanded secrecy. The emails were sent from accounts associated with Germany, France and Israel using servers in Moscow.","how_it_worked":"The fraudsters built a two-sided pretext so that the controller's natural verification instinct was satisfied inside the scam itself. Emails from the apparent CEO announced a blockbuster confidential acquisition in China and instructed him to coordinate with a named KPMG contact; emails from that fake auditor then corroborated the deal and supplied wiring details. Secrecy was explicitly demanded because of supposed securities sensitivity, which discouraged any check with colleagues. The story was plausible because Scoular genuinely had expansion discussions involving China. Three escalating transfers cleared over several days before the deception surfaced, by which point the funds were beyond reach.","lessons":"External confirmation must originate from the victim, not the requester: calling KPMG's published main number or the CEO's office, rather than the contact details supplied in the email, would have ended the scheme immediately.","confidence":"Confirmed","sources":[{"title":"55th Largest Private Company In America Sent Millions To China Because An Email Told Them To","url":"https://www.techdirt.com/2015/02/06/55th-largest-private-company-america-sent-millions-to-china-because-email-told-them-to/","publisher":"Techdirt"}],"entry_type":"incident","slug":"2014-scoular-company-wires-17-2-million-after-fake-ceo-and-auditor-emails","year":2014,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2014-scoular-company-wires-17-2-million-after-fake-ceo-and-auditor-emails"}}