{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2016-belgian-bank-crelan-loses-70-million-to-ceo-fraud-payment-orders"},"incident":{"title":"Belgian bank Crelan loses €70 million to CEO-fraud payment orders","date":"2016-01","date_precision":"month","victim_org":"Crelan NV/SA","sector":"Financial Services","country":"Belgium","primary_vector":"Business Email Compromise","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":75800000,"loss_note":"€70 million (about $75.8 million). The bank said reserves absorbed the loss and customers were not affected.","records_affected":null,"threat_actor":null,"summary":"Belgian bank Crelan disclosed in January 2016 that an internal audit had uncovered a fraud costing approximately €70 million. Attackers either compromised or convincingly imitated a senior executive's email account and sent payment orders to the bank's finance department. Crelan notified Belgian authorities and its risk and audit committees, and said the loss was covered by reserves without impact on customers or partners.","how_it_worked":"The scheme attacked a bank's own treasury payment process rather than customer accounts. Fraudsters used a compromised or spoofed executive mailbox to issue payment instructions to finance staff, relying on the authority of the sender and on urgency and confidentiality to suppress questions. Because the orders came through the expected internal channel and carried apparently legitimate executive approval, they were processed without out-of-band confirmation. The diversion went undetected until routine internal audit work flagged irregularities, at which point the funds had already left the institution. Crelan reported the matter to prosecutors and reviewed its internal control framework.","lessons":"Internal payment instructions deserve the same scrutiny as external ones: even executive-originated transfers should require verification through a separate channel and a segregation-of-duties check before release.","confidence":"Confirmed","sources":[{"title":"Belgian bank Crelan loses €70 million to BEC scammers","url":"https://www.helpnetsecurity.com/2016/01/26/belgian-bank-crelan-loses-e70-million-to-bec-scammers/","publisher":"Help Net Security"}],"entry_type":"incident","slug":"2016-belgian-bank-crelan-loses-70-million-to-ceo-fraud-payment-orders","year":2016,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2016-belgian-bank-crelan-loses-70-million-to-ceo-fraud-payment-orders"}}