{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2020-puerto-rico-government-agency-sends-2-6-million-to-fraudulent-account"},"incident":{"title":"Puerto Rico government agency sends $2.6 million to fraudulent account","date":"2020-01-17","date_precision":"day","victim_org":"Puerto Rico Industrial Development Company (PRIDCO)","sector":"Government","country":"Puerto Rico","primary_vector":"Business Email Compromise","secondary_vectors":["Vendor / Supply Chain Impersonation"],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":2600000,"loss_note":"$2.6 million transferred on January 17, 2020. Recovery outcome not confirmed in the cited reporting.","records_affected":null,"threat_actor":null,"summary":"Puerto Rico's Industrial Development Company transferred $2.6 million on January 17, 2020 to an account controlled by fraudsters after officials received an email claiming that the bank account used for remittance payments had changed. The agency's finance director, Rubén Rivera, filed a police complaint in February 2020 after the diversion was discovered. The incident occurred while the territory was in a prolonged fiscal crisis.","how_it_worked":"The scheme exploited an inter-agency remittance payment process in which large periodic transfers are routine and the receiving party is trusted. The fraudulent email announced a change of banking details for those remittances, a message finance staff had reason to expect from time to time, and gave no cause for alarm because it referenced a genuine payment relationship. Officials updated the destination details and executed the scheduled payment of $2.6 million into the criminals' account. The loss surfaced only when the legitimate recipient's non-receipt was noticed, by which time the funds had left the account, prompting a complaint to police and a wider review of government payment controls.","lessons":"Government payment offices need a standing rule that account-change notices are never actioned from email alone, plus periodic reconciliation with recipients to catch a diversion within days rather than weeks.","confidence":"Confirmed","sources":[{"title":"Official says Puerto Rico government lost $2.6M in phishing scam","url":"https://www.pbs.org/newshour/nation/official-says-puerto-rico-government-lost-2-6m-in-phishing-scam","publisher":"PBS NewsHour / Associated Press"}],"entry_type":"incident","slug":"2020-puerto-rico-government-agency-sends-2-6-million-to-fraudulent-account","year":2020,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2020-puerto-rico-government-agency-sends-2-6-million-to-fraudulent-account"}}