{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2015-mattel-wires-3-million-to-chinese-account-in-ceo-impersonation-scam-reco"},"incident":{"title":"Mattel wires $3 million to Chinese account in CEO impersonation scam, recovers it","date":"2015-04-30","date_precision":"day","victim_org":"Mattel, Inc.","sector":"Consumer","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":3000000,"loss_note":"$3 million transferred and subsequently recovered in full after Chinese authorities froze the receiving account.","records_affected":null,"threat_actor":null,"summary":"On April 30, 2015 a Mattel finance executive wired $3 million to a bank in Wenzhou, China after receiving an email purporting to come from newly appointed chief executive Christopher Sinclair. The fraud was recognized the same day. Because May 1 was a banking holiday in China, Mattel was able to work with U.S. and Chinese law enforcement and the receiving bank to freeze the account, and the funds were returned within days.","how_it_worked":"The attackers studied Mattel's payment approval rule, which required sign-off from two senior managers, and timed their approach to a leadership transition when a new CEO's email habits were unfamiliar. They sent a spoofed request from the incoming chief executive asking for a vendor payment to a new supplier in China, framed as routine business expansion. The finance executive believed the request satisfied the two-approver rule because the CEO himself appeared to be one of the approvers. Only afterward, when she mentioned it to Sinclair, was the fraud exposed. A Chinese public holiday delayed onward movement of the money long enough for law enforcement to freeze it.","lessons":"Approval rules must count only independently verified approvers; a request that supplies its own authorization by email is not dual control, and new-vendor payments deserve a mandatory verification step.","confidence":"Confirmed","sources":[{"title":"Chinese scammers take Mattel to the bank, phishing them for $3 million","url":"https://www.csoonline.com/article/555513/chinese-scammers-take-mattel-to-the-bank-phishing-them-for-3-million.html","publisher":"CSO Online"}],"entry_type":"incident","slug":"2015-mattel-wires-3-million-to-chinese-account-in-ceo-impersonation-scam-reco","year":2015,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2015-mattel-wires-3-million-to-chinese-account-in-ceo-impersonation-scam-reco"}}