{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2017-save-the-children-federation-loses-nearly-1-million-in-charity-bec-fraud"},"incident":{"title":"Save the Children Federation loses nearly $1 million in charity BEC fraud","date":"2017-05","date_precision":"month","victim_org":"Save the Children Federation, Inc.","sector":"Nonprofit","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":["Credential Phishing Portal"],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss","Credential Theft"],"loss_usd":1000000,"loss_note":"Approximately $1 million diverted; insurance covered most of it, leaving the charity with a net loss of about $112,000.","records_affected":null,"threat_actor":null,"summary":"In May 2017 an attacker took over a Save the Children employee's email account and created fraudulent invoices and payment documents for solar panels supposedly destined for health centers in Pakistan. Nearly $1 million was wired to an entity in Japan instead. Insurance covered most of the loss, leaving roughly $112,000 unrecovered. The incident became public in December 2018 when a journalist found the diversion disclosed in the charity's IRS filing.","how_it_worked":"The attacker first phished credentials and gained control of a legitimate internal mailbox, which removed the usual lookalike-domain tell from the fraud. Operating from inside the organization's own email, they generated invoices and supporting documentation for a plausible program expense, solar equipment for Pakistani health facilities, that matched the charity's real field activities. Approvals then flowed through normal internal channels because every message came from a trusted colleague's real address. Payment was directed to a bank account in Japan, a jurisdiction inconsistent with the stated project, and the funds were gone before the discrepancy was noticed during later reconciliation.","lessons":"Account takeover defeats sender-based trust, so payment approvals for program expenses need out-of-band confirmation plus a geography sanity check between the vendor, the project and the receiving bank.","confidence":"Confirmed","sources":[{"title":"Save the Children Charity Org Scammed for Almost $1 Million","url":"https://www.bleepingcomputer.com/news/security/save-the-children-charity-org-scammed-for-almost-1-million/","publisher":"BleepingComputer"}],"entry_type":"incident","slug":"2017-save-the-children-federation-loses-nearly-1-million-in-charity-bec-fraud","year":2017,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2017-save-the-children-federation-loses-nearly-1-million-in-charity-bec-fraud"}}