{"meta":{"database":"Global Social Engineering Impact Database","url":"https://global-social-engineering-impact-da.vercel.app","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","generated":"2026-08-29T08:15:34.535Z","total":14,"returned":14,"limit":50,"offset":0,"next":null,"note":"Read loss_kind before summing loss_usd: only direct_loss and ransom_paid are comparable. Entries with entry_type \"benchmark\" are aggregate agency statistics and overlap with everything else by construction."},"results":[{"title":"Prince Group chairman indicted over Cambodian forced-labour pig butchering compounds","date":"2025-10-14","date_precision":"day","victim_org":"Global cryptocurrency investment fraud victims including US consumers (multi-victim campaign)","sector":"Consumer","country":"Cambodia","primary_vector":"Romance / Investment Scam","secondary_vectors":["Fake Job Offer / Recruitment Lure","Smishing (SMS)"],"ai_involvement":"Unknown","ai_notes":"The indictment does not attribute the schemes to AI tooling, though contemporaneous reporting on the sector describes AI-assisted personas.","outcomes":["Cryptocurrency Theft","Wire Fraud / Financial Loss"],"loss_usd":15000000000,"loss_note":"Approximately 127,271 bitcoin, worth roughly $15 billion at the time, were seized in what DOJ called its largest forfeiture action ever. This is the seizure value, not a per-victim loss total.","records_affected":null,"threat_actor":"Chen Zhi and the Prince Holding Group (indicted)","summary":"On 14 October 2025 the Department of Justice unsealed a wire fraud and money laundering conspiracy indictment in Brooklyn against Chen Zhi, founder and chairman of Cambodia's Prince Holding Group, and announced the seizure of approximately 127,271 bitcoin worth about $15 billion. Prosecutors said Prince Group ran dozens of forced-labour scam compounds across Cambodia, ringed with high walls and barbed wire, where trafficked workers were confined and made to run cryptocurrency investment fraud against victims worldwide. One Brooklyn-based network alone handled fraudulent transfers from over 250 New York victims.","how_it_worked":"Workers inside the compounds contacted strangers through messaging apps and social media using fabricated personas, opening with an apparent wrong number or a friendly cold approach. Over weeks or months they built a personal relationship, often romantic, before introducing a cryptocurrency investment opportunity backed by a fake trading platform that displayed rising balances and permitted small early withdrawals to prove legitimacy. Victims were then pressed to deposit progressively larger sums, and any attempt to withdraw triggered demands for taxes or fees. The compound operators tracked which schemes ran from which rooms and logged the profits.","lessons":"Banks and exchanges need behavioural interdiction for customers making escalating transfers to newly seen crypto addresses after prolonged online-only relationships, since the victim will defend the transaction when asked directly.","confidence":"Reported","sources":[{"title":"Chairman of Prince Group Indicted for Operating Cambodian Forced Labor Scam Compounds","url":"https://www.justice.gov/opa/pr/chairman-prince-group-indicted-operating-cambodian-forced-labor-scam-compounds-engaged","publisher":"U.S. Department of Justice"},{"title":"U.S. and U.K. Take Largest Action Ever Targeting Cybercriminal Networks in Southeast Asia","url":"https://home.treasury.gov/news/press-releases/sb0278","publisher":"U.S. Department of the Treasury"}],"entry_type":"campaign","slug":"2025-prince-group-chairman-indicted-over-cambodian-forced-labour-pig-butcheri","year":2025,"loss_kind":"seizure","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-prince-group-chairman-indicted-over-cambodian-forced-labour-pig-butcheri"},{"title":"US sanctions Myanmar and Cambodia scam compound operators over forced-labour fraud","date":"2025-09-08","date_precision":"day","victim_org":"US, European and Chinese scam victims (multi-victim campaign)","sector":"Consumer","country":"Myanmar and Cambodia","primary_vector":"Fake Job Offer / Recruitment Lure","secondary_vectors":["Romance / Investment Scam","Insider Recruitment"],"ai_involvement":"Unknown","ai_notes":"The sanctions announcement does not characterise AI use in the compounds' scam operations.","outcomes":["Wire Fraud / Financial Loss","Cryptocurrency Theft"],"loss_usd":10000000000,"loss_note":"Over $10 billion in losses to Americans was cited in connection with the announcement; this is a sector-wide aggregate, not a single-incident figure.","records_affected":null,"threat_actor":"Shwe Kokko / Yatai International Holdings Group network and Cambodian casino operators","summary":"On 8 September 2025 the US Treasury and State Department sanctioned operators of Southeast Asian scam compounds. Nine people and companies were targeted around the Shwe Kokko hub in Myanmar, including Saw Chit Thu and his Chit Linn Myaing entities, She Zhijiang and Yatai International Holdings Group. Four individuals and six entities tied to Cambodian casino operations in Sihanoukville and Bavet were also designated. In October 2025 Myanmar authorities detained over 2,000 suspects at KK Park, and in November 2025 arrested 346 foreign nationals at Shwe Kokko, seizing nearly 10,000 mobile phones.","how_it_worked":"The compounds are staffed by recruitment fraud. Thousands of people are lured with fake job offers, typically advertised as customer service, translation or IT work at attractive salaries in Thailand or Cambodia, then transported across borders, held against their will and forced to run scams targeting people in the United States, Europe and China. Inside, workers follow scripted romance and investment playbooks against assigned target lists, with quotas enforced by violence. The compound model industrialises social engineering: the recruitment lure supplies the labour, and the labour supplies the volume of romance and investment approaches.","lessons":"Because the front-line operators are themselves trafficking victims, effective controls sit upstream in sanctions, telecom and payment infrastructure rather than in prosecuting individual callers.","confidence":"Confirmed","sources":[{"title":"US sanctions companies behind cyber scam centers in Cambodia, Myanmar","url":"https://therecord.media/us-sanctions-companies-southeast-asia-scam-compounds","publisher":"The Record (Recorded Future News)"},{"title":"Myanmar Military Arrests Hundreds in Raid on Thai-Border Scam Center","url":"https://www.occrp.org/en/news/myanmar-military-arrests-hundreds-in-raid-on-thai-border-scam-center","publisher":"OCCRP"}],"entry_type":"campaign","slug":"2025-us-sanctions-myanmar-and-cambodia-scam-compound-operators-over-forced-la","year":2025,"loss_kind":"aggregate","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-us-sanctions-myanmar-and-cambodia-scam-compound-operators-over-forced-la"},{"slug":"2025-interpol-operation-serengeti-2-0-nets-1-209-arrests-over-bec-and-romance","title":"Interpol Operation Serengeti 2.0 nets 1,209 arrests over BEC and romance fraud","date":"2025-08","date_precision":"month","year":2025,"victim_org":"Approximately 88,000 victims across 18 African countries and the UK","sector":"Other","country":"Multiple","primary_vector":"Business Email Compromise","secondary_vectors":["Romance / Investment Scam","Spear Phishing (Email)"],"ai_involvement":"No AI reported","ai_notes":"","outcomes":["Wire Fraud / Financial Loss","Identity Theft"],"loss_usd":485000000,"loss_kind":"aggregate","loss_note":"Interpol put victim losses across the operation at about $485 million, with roughly $97.4 million recovered.","records_affected":null,"threat_actor":null,"summary":"Interpol announced in August 2025 that Operation Serengeti 2.0, conducted from June to August across 18 African countries and the UK, led to 1,209 arrests, the dismantling of 11,432 malicious infrastructures and the recovery of about $97.4 million. The operation targeted ransomware, business email compromise, online scams and investment fraud affecting some 88,000 victims, with total losses estimated at roughly $485 million.","how_it_worked":"The networks disrupted ran industrialised deception. Business email compromise crews compromised or spoofed corporate mailboxes, watched invoice threads, then sent payment-diversion instructions from an address one character off the real one, timed to arrive when a genuine payment was due. Romance and investment crews cultivated victims over weeks on dating and messaging apps before introducing fake trading platforms that displayed fabricated gains to encourage larger deposits. In both cases the trust signal abused was an established relationship, commercial or personal, and the pressure was a closing window: a supplier deadline, or a limited investment opportunity.","lessons":"Verified callback to a previously known phone number before any change of bank details, and platform-level friction on first-time large transfers to new payees, cut the largest share of these losses.","confidence":"Confirmed","sources":[{"title":"African authorities dismantle massive cybercrime and fraud networks, recover millions","url":"https://www.interpol.int/en/News-and-Events/News/2025/African-authorities-dismantle-massive-cybercrime-and-fraud-networks-recover-millions","publisher":"Interpol"},{"title":"Massive anti-cybercrime operation leads to over 1,200 arrests in Africa","url":"https://www.bleepingcomputer.com/news/security/massive-anti-cybercrime-operation-leads-to-over-1-200-arrests-in-africa/","publisher":"BleepingComputer"}],"entry_type":"campaign","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-interpol-operation-serengeti-2-0-nets-1-209-arrests-over-bec-and-romance"},{"title":"DOJ moves to forfeit $225M in crypto traced to pig butchering victims","date":"2025-06-18","date_precision":"day","victim_org":"US consumers (multi-victim campaign)","sector":"Consumer","country":"United States","primary_vector":"Romance / Investment Scam","secondary_vectors":["Smishing (SMS)","Spear Phishing (Email)","Tech Support Scam"],"ai_involvement":"Unknown","ai_notes":"The forfeiture complaint focuses on the money laundering trail rather than the tooling used to create the scam personas.","outcomes":["Cryptocurrency Theft","Wire Fraud / Financial Loss","Identity Theft","Data Breach"],"loss_usd":19400000,"loss_note":"Over $225 million in USDT was targeted for forfeiture. DOJ identified 434 victims, of whom 60 named victims lost a combined $19.4 million; the $19.4M figure is used here as the confirmed victim loss.","records_affected":434,"threat_actor":null,"summary":"On 18 June 2025 the Department of Justice filed a civil forfeiture complaint seeking over $225 million in USDT laundered from international pig butchering investment scams, described at the time as its largest cryptocurrency seizure of that kind. The filing identified 434 victims, including 60 named victims who lost a combined $19.4 million. Among the traced funds were $3.3 million connected to Shan Hanes, the former Heartland Tri-State Bank chief executive whose $47.1 million embezzlement to pay scammers collapsed the Kansas bank in 2023.","how_it_worked":"Victims were groomed online and induced to send tether to any of 93 deposit addresses controlled by the network. The proceeds were then split across up to 100 intermediary wallets to break the trail and to blend deposits from many victims, before consolidation into 22 primary exchange accounts and 122 further accounts linked by shared IP addresses and reused know-your-customer documents. The Heartland Tri-State case shows the depth of the psychological hold: a serving bank chief executive stole from his own bank, his church, an investment club and his daughter's college fund to keep feeding the scam, and received a 24-year sentence in August 2024.","lessons":"The rule that a legitimate employer never requires an employee to deposit money to be paid is the whole control; payment providers should also flag consumer crypto purchases immediately preceding transfers to newly seen platforms.","confidence":"Confirmed","sources":[{"title":"DOJ Ties Kansas Bank Collapse to $225 Million 'Pig Butchering' Seizure","url":"https://www.coindesk.com/policy/2025/06/18/doj-ties-kansas-bank-collapse-to-225-million-pig-butchering-seizure","publisher":"CoinDesk"},{"title":"New FTC Data Show Skyrocketing Consumer Reports About Game-Like Online Job Scams","url":"https://www.ftc.gov/news-events/news/press-releases/2024/12/new-ftc-data-show-skyrocketing-consumer-reports-about-game-online-job-scams","publisher":"Federal Trade Commission"},{"title":"FBI Releases Annual Internet Crime Report","url":"https://www.fbi.gov/news/press-releases/fbi-releases-annual-internet-crime-report","publisher":"Federal Bureau of Investigation"}],"entry_type":"campaign","slug":"2025-doj-moves-to-forfeit-225m-in-crypto-traced-to-pig-butchering-victims","year":2025,"loss_kind":"aggregate","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-doj-moves-to-forfeit-225m-in-crypto-traced-to-pig-butchering-victims"},{"title":"Hong Kong arrests 31 in second deepfake romance fraud ring targeting Southeast Asia","date":"2025-01","date_precision":"month","victim_org":"Victims in Taiwan, Singapore and Malaysia","sector":"Consumer","country":"Hong Kong","primary_vector":"Romance / Investment Scam","secondary_vectors":["Deepfake Video Call"],"ai_involvement":"Confirmed AI-enabled","ai_notes":"The syndicate combined photographs of attractive people scraped online with deepfake technology to create and sustain fictitious personas on dating apps.","outcomes":["Wire Fraud / Financial Loss","Cryptocurrency Theft"],"loss_usd":4370000,"loss_note":"Over HK$34 million, approx US$4.37 million","records_affected":null,"threat_actor":"Hong Kong-based fraud syndicate operating from Kowloon Bay","summary":"Hong Kong police arrested 31 people on 2 and 3 January 2025 over a deepfake-enabled romance and investment fraud syndicate that operated from two premises in Kowloon Bay and took more than HK$34 million (about US$4.37 million) from victims in Taiwan, Singapore and Malaysia. Members were trained to approach targets on dating apps using online photographs of attractive people combined with deepfake technology. It was the second major deepfake fraud bust by Hong Kong authorities in three months.","how_it_worked":"Recruits worked from scripts and training materials, opening on dating apps with fabricated female personas assembled from scraped photographs and rendered live with face-swapping software when a target asked for video proof. The romance was cultivated over weeks so that the eventual investment pitch arrived from someone the victim believed they knew personally rather than from a stranger. Targets in neighbouring jurisdictions were chosen partly because cross-border reporting and recovery are slower. Funds were routed into cryptocurrency, which made reversal difficult once the persona went dark.","lessons":"Cross-border anti-fraud coordination and dating-platform detection of face-swap artefacts on live video are the two controls that materially shrink this model.","confidence":"Confirmed","sources":[{"title":"Hong Kong police arrest 31 over deepfakes used to scam victims in Singapore, Malaysia","url":"https://www.scmp.com/news/hong-kong/law-and-crime/article/3293476/hong-kong-police-arrest-31-who-used-deepfakes-scam-victims-singapore-malaysia","publisher":"South China Morning Post"}],"entry_type":"campaign","slug":"2025-hong-kong-arrests-31-in-second-deepfake-romance-fraud-ring-targeting-sou","year":2025,"loss_kind":"aggregate","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-hong-kong-arrests-31-in-second-deepfake-romance-fraud-ring-targeting-sou"},{"title":"FBI warns criminals are using generative AI to scale voice-clone and identity fraud","date":"2024-12-03","date_precision":"day","victim_org":"US consumers, including seniors targeted by family-emergency voice clones (multi-victim campaign)","sector":"Consumer","country":"United States","primary_vector":"Voice Clone / Audio Deepfake","secondary_vectors":["Deepfake Video Call","Romance / Investment Scam","Spear Phishing (Email)"],"ai_involvement":"Confirmed AI-enabled","ai_notes":"The entire advisory concerns criminal use of generative AI: AI text for phishing and fake profiles, AI images for fake IDs and personas, voice cloning to impersonate relatives and account holders, and real-time video synthesis to impersonate executives and authorities.","outcomes":["Wire Fraud / Financial Loss","Identity Theft","Extortion","Cryptocurrency Theft"],"loss_usd":null,"loss_note":"The advisory does not publish an aggregate loss figure for AI-enabled fraud.","records_affected":null,"threat_actor":null,"summary":"On 3 December 2024 the FBI's Internet Crime Complaint Center published an advisory titled Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud. It documents AI-generated text used for phishing, fake social media profiles and fraudulent investment sites; AI-generated images used for profile photos, fabricated identification documents and disaster imagery for fake charity appeals; and voice and video synthesis used to impersonate relatives, account holders and executives.","how_it_worked":"Voice cloning is the pivotal technique for consumer harm. A short sample of a person's speech, readily available from social media video, is enough to synthesise a distressed relative calling to say they have been in an accident or arrested and need money immediately. The lever is the recognisable voice of a loved one under duress, which suppresses verification instincts far more effectively than any script. The same technology is used to satisfy bank voice authentication as an account holder, and real-time video synthesis extends it to live calls impersonating executives or providing proof of legitimacy to a romance or investment target. AI translation also strips the grammatical errors that once exposed foreign operators.","lessons":"The FBI's own recommendation is the practical control: agree a family or organisational verification code word in advance, and independently call back on a known number before acting on any urgent request.","confidence":"Confirmed","sources":[{"title":"Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud","url":"https://www.ic3.gov/PSA/2024/PSA241203","publisher":"FBI Internet Crime Complaint Center"}],"entry_type":"benchmark","slug":"2024-fbi-warns-criminals-are-using-generative-ai-to-scale-voice-clone-and-ide","year":2024,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2024-fbi-warns-criminals-are-using-generative-ai-to-scale-voice-clone-and-ide"},{"title":"Deepfake Elon Musk videos drive crypto investment scams against US consumers","date":"2024-11","date_precision":"month","victim_org":"Multiple US consumers","sector":"Consumer","country":"United States","primary_vector":"Watering Hole / Malvertising","secondary_vectors":["Romance / Investment Scam","Deepfake Video Call"],"ai_involvement":"Confirmed AI-enabled","ai_notes":"Scammers generated AI video and voice of Elon Musk pitching cryptocurrency investment schemes and distributed them as ads and posts on Facebook and TikTok.","outcomes":["Wire Fraud / Financial Loss","Cryptocurrency Theft"],"loss_usd":null,"loss_note":"Individual victim Heidi Swan lost over US$10,000; Deloitte estimated generative AI contributed to more than US$12 billion in US fraud losses in 2023, projected to reach US$40 billion by 2027","records_affected":null,"threat_actor":null,"summary":"By late 2024 Elon Musk had become the most frequently impersonated figure in deepfake investment fraud, with AI-generated videos of him promoting crypto schemes circulating widely on Facebook and TikTok. CBS News reported in November 2024 on Heidi Swan, a 62-year-old healthcare worker who deposited more than US$10,000 with a fake platform after seeing such a video. Researchers and Deloitte estimated that AI-generated content contributed to more than US$12 billion in US fraud losses in 2023.","how_it_worked":"The lure ran on the credibility of a single very famous investor whose views on cryptocurrency are widely known, so a video of him endorsing a platform confirmed what many targets already half-believed. Distribution through paid social advertising delivered the content inside trusted feeds and let operators target older users with disposable savings. The synthetic Musk described a limited-time opportunity with outsized returns, and the follow-through moved victims onto a bogus exchange with a support representative who coached them through funding the account. Fabricated balance growth and, in some cases, small permitted withdrawals sustained belief and encouraged larger deposits until withdrawals were blocked.","lessons":"Celebrity endorsement is never a basis for investing; platforms must verify advertiser identity and screen for synthetic likeness of public figures before ads run.","confidence":"Reported","sources":[{"title":"Deepfakes of Elon Musk are contributing to billions of dollars in fraud losses in the U.S.","url":"https://www.cbsnews.com/texas/news/deepfakes-ai-fraud-elon-musk/","publisher":"CBS News"},{"title":"Deepfake Elon Musk Videos Have Reportedly Contributed to Billions in Fraud","url":"https://incidentdatabase.ai/cite/795/","publisher":"AI Incident Database"}],"entry_type":"campaign","slug":"2024-deepfake-elon-musk-videos-drive-crypto-investment-scams-against-us-consu","year":2024,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2024-deepfake-elon-musk-videos-drive-crypto-investment-scams-against-us-consu"},{"title":"Hong Kong police dismantle HK$360M deepfake romance and crypto investment ring","date":"2024-10","date_precision":"month","victim_org":"Men across Asia targeted through dating apps","sector":"Consumer","country":"Hong Kong","primary_vector":"Romance / Investment Scam","secondary_vectors":["Deepfake Video Call"],"ai_involvement":"Confirmed AI-enabled","ai_notes":"Syndicate members used AI face-swapping to replace their own faces with those of attractive women during video calls with victims, sustaining the fiction of a relationship.","outcomes":["Wire Fraud / Financial Loss","Cryptocurrency Theft"],"loss_usd":46000000,"loss_note":"HK$360 million, approx US$46 million","records_affected":null,"threat_actor":"Hong Kong-based syndicate with reported triad links","summary":"Hong Kong police announced on 14 October 2024 that they had arrested 27 people, aged 21 to 34, over a deepfake-assisted romance and cryptocurrency investment fraud that took about HK$360 million (US$46 million) from victims across Asia. The syndicate operated from a 4,000-square-foot industrial unit in Hung Hom, recruited digital media graduates to build fake trading platforms, and used AI face-swapping on video calls. Police seized more than 100 phones, cash, computers, luxury watches and training manuals on manipulating victims.","how_it_worked":"Operators opened on dating apps with AI-generated or face-swapped profiles of attractive women and invested weeks in ordinary conversation, building an emotional bond before money was ever mentioned. Video calls were the decisive trust signal, because a target who has seen and spoken with the person on camera discounts warnings about catfishing. Once the relationship felt real, the persona introduced a cryptocurrency trading platform run by the syndicate, showing fabricated gains and letting small withdrawals succeed so the returns appeared genuine. Pressure came from a mixture of intimacy and fear of missing out, and the training documents seized by police show the manipulation was scripted, not improvised.","lessons":"Reverse-image and liveness checks on dating profiles help, but the durable control is treating any investment platform introduced by an online romantic contact as fraudulent by default.","confidence":"Confirmed","sources":[{"title":"Hong Kong fraudsters use deepfake tech to swindle love-struck men out of HK$360 million","url":"https://www.scmp.com/news/hong-kong/law-and-crime/article/3282345/hong-kong-fraudsters-use-deepfake-tech-swindle-love-struck-men-out-hk360-million","publisher":"South China Morning Post"},{"title":"Police arrest 27 for deepfake love scams totaling $360m, seizes scam-training documents","url":"https://www.thestandard.com.hk/news/article/221507/Police-arrest-27-for-deepfake-love-scams-totaling-360m-seizes-scam-training-documents","publisher":"The Standard (Hong Kong)"}],"entry_type":"campaign","slug":"2024-hong-kong-police-dismantle-hk-360m-deepfake-romance-and-crypto-investmen","year":2024,"loss_kind":"aggregate","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2024-hong-kong-police-dismantle-hk-360m-deepfake-romance-and-crypto-investmen"},{"title":"French woman loses EUR 830,000 to an AI-image 'Brad Pitt' romance scam","date":"2023-02","date_precision":"month","victim_org":"Private individual in France (identified only as 'Anne')","sector":"Consumer","country":"France","primary_vector":"Romance / Investment Scam","secondary_vectors":[],"ai_involvement":"Confirmed AI-enabled","ai_notes":"Scammers sent AI-generated photographs purporting to show Brad Pitt in a hospital bed, along with images of a fake passport, to sustain the impersonation across an 18-month relationship.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":857900,"loss_note":"EUR 830,000, approx US$858,000","records_affected":null,"threat_actor":"Nigerian-linked fraud network under French investigation","summary":"Beginning in February 2023, a 53-year-old French woman known publicly as Anne was drawn into an online relationship with someone posing as actor Brad Pitt. Over about 18 months she sent EUR 830,000, largely after being told he needed money for kidney cancer treatment and that his accounts were frozen by divorce proceedings. AI-generated images of the actor in hospital and a forged passport reinforced the deception. She realised she had been defrauded on seeing genuine photographs of Pitt with his partner, and filed a police complaint; the case became public in January 2025 when French broadcaster TF1 aired and then withdrew her interview.","how_it_worked":"Contact began through social media with a persona claiming to be the actor's mother, which lent credibility before the celebrity persona itself appeared. The relationship was built slowly with daily messages, declarations of love and a promise of marriage, so that by the time money was requested the target was emotionally invested rather than evaluating a proposition. AI-generated hospital photographs, tailored to each new claim, answered the natural demand for proof, and a fabricated passport addressed identity doubts. The medical emergency supplied urgency, and the story that the actor's assets were frozen in divorce explained why a wealthy man would need her money at all.","lessons":"Any claim of celebrity contact should be treated as fraudulent absent verified representation, and banks flagging repeated large outbound transfers from an unusual customer profile can interrupt the sequence.","confidence":"Reported","sources":[{"title":"Nigerian scammers accused in AI-driven fake Brad Pitt fraud","url":"https://www.france24.com/en/live-news/20250121-nigerian-scammers-accused-in-ai-driven-fake-brad-pitt-fraud","publisher":"AFP via France 24"},{"title":"AI Brad Pitt convinced a French woman to pay EUR 830K for kidney treatment","url":"https://www.ccn.com/news/technology/ai-brad-pitt-convinced-french-woman-pay-e830k/","publisher":"CCN"}],"entry_type":"incident","slug":"2023-french-woman-loses-eur-830-000-to-an-ai-image-brad-pitt-romance-scam","year":2023,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2023-french-woman-loses-eur-830-000-to-an-ai-image-brad-pitt-romance-scam"},{"title":"Ramon 'Hushpuppi' Abbas sentenced for laundering BEC and cyber-heist proceeds","date":"2022-11-07","date_precision":"day","victim_org":"Multiple (New York law firm, a Maltese bank, a Qatari businessman, others)","sector":"Other","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":["Vendor / Supply Chain Impersonation","Romance / Investment Scam"],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss","Identity Theft"],"loss_usd":null,"loss_note":"Restitution ordered of $1,732,841. Individual episodes included about $922,857 fraudulently induced from a New York law firm in October 2019 and an intended $14.7 million from a foreign bank cyber-heist; prosecutors said he conspired to launder over $300 million.","records_affected":null,"threat_actor":"Ramon Olorunwa Abbas ('Ray Hushpuppi'), Nigeria/UAE, with co-conspirator Ghaleb Alaumary","summary":"Ramon Olorunwa Abbas, the Instagram figure known as Ray Hushpuppi, was arrested in Dubai in June 2020, pleaded guilty in April 2021 and was sentenced on November 7, 2022 to 135 months in federal prison with $1,732,841 in restitution. He laundered proceeds of business email compromise frauds, bank cyber-heists and school-financing scams, including about $922,857 induced from a New York law firm and funds from a January 2019 attack on a Maltese bank.","how_it_worked":"Abbas supplied the financial plumbing that makes BEC profitable. Co-conspirators compromised or spoofed the email of parties to real transactions, such as a law firm holding client funds for a closing, and issued altered wire instructions that matched a payment the victim already expected to make. Abbas provided and coordinated the receiving accounts, including accounts opened with fraudulent identity documents, and moved the proceeds rapidly across jurisdictions to defeat recall. He also ran advance-fee variants, extracting roughly $330,000 from a Qatari businessman seeking a $15 million school loan and then demanding further payments framed as taxes.","lessons":"Payment recipients in escrow and closing transactions should be verified by phone against instructions exchanged before the transaction opened, since the diversion email typically arrives at the exact moment a payment is expected.","confidence":"Confirmed","sources":[{"title":"Nigerian Man Sentenced to Over 11 Years in Federal Prison for Conspiring to Launder Tens of Millions of Dollars from Online Scams","url":"https://www.justice.gov/usao-cdca/pr/nigerian-man-sentenced-over-11-years-federal-prison-conspiring-launder-tens-millions","publisher":"U.S. Department of Justice, C.D. Cal."}],"entry_type":"campaign","slug":"2022-ramon-hushpuppi-abbas-sentenced-for-laundering-bec-and-cyber-heist-proce","year":2022,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2022-ramon-hushpuppi-abbas-sentenced-for-laundering-bec-and-cyber-heist-proce"},{"title":"Deepfake of Binance communications chief used to scam crypto projects on video calls","date":"2022-08","date_precision":"month","victim_org":"Multiple cryptocurrency projects seeking Binance listings","sector":"Cryptocurrency","country":"Multiple countries","primary_vector":"Deepfake Video Call","secondary_vectors":["Romance / Investment Scam"],"ai_involvement":"Confirmed AI-enabled","ai_notes":"Binance chief communications officer Patrick Hillmann said attackers built an AI video 'hologram' of him from his past news interviews and TV appearances and used it live on Zoom calls.","outcomes":["Wire Fraud / Financial Loss","Cryptocurrency Theft"],"loss_usd":null,"loss_note":"Losses to individual projects were not disclosed","records_affected":null,"threat_actor":null,"summary":"In August 2022 Binance disclosed that a 'sophisticated hacking team' had produced a deepfake video likeness of chief communications officer Patrick Hillmann and used it on Zoom calls with representatives of cryptocurrency projects. The impersonator offered help getting tokens listed on Binance and solicited payments and information. Hillmann said several project managers were convinced before the fraud was discovered, and that the clone was built from his publicly available interview footage.","how_it_worked":"The pretext was the single thing small crypto projects want most, a listing on the largest exchange, and the caller occupied a role that plausibly controls access to it. Contact was made over social channels and then escalated to a Zoom call, where the deepfake of a face the targets had seen in Binance media coverage supplied the trust signal that a mere email could not. Because listing discussions are routinely confidential and involve fees, requests for money and business documents did not look out of place. Victims were pushed to move fast on the implied scarcity of a listing slot, and only later checked with Binance through official channels.","lessons":"Exchange listing and partnership discussions should be confirmed through the company's published contact channels, and no vendor should treat a video likeness as proof of employment.","confidence":"Reported","sources":[{"title":"Binance exec says scammers made a deepfake hologram of him","url":"https://www.theregister.com/2022/08/23/binance_deepfake_scam/","publisher":"The Register"},{"title":"Deepfake hologram targets Binance and crypto community","url":"https://www.malwarebytes.com/blog/news/2022/08/deepfake-hologram-targets-binance-and-crypto-community","publisher":"Malwarebytes Labs"}],"entry_type":"campaign","slug":"2022-deepfake-of-binance-communications-chief-used-to-scam-crypto-projects-on","year":2022,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2022-deepfake-of-binance-communications-chief-used-to-scam-crypto-projects-on"},{"title":"Operation Eagle Sweep: 65 arrests in global BEC disruption","date":"2022-03-30","date_precision":"day","victim_org":"Multiple businesses and individuals (500+ U.S. victims)","sector":"Other","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":["Vendor / Supply Chain Impersonation","Romance / Investment Scam"],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss","Attempt Blocked"],"loss_usd":null,"loss_note":"Not a single-victim loss. The targeted actors were tied to more than 500 U.S. victims and over $51 million in losses; FBI noted nearly $2.4 billion in reported BEC/EAC losses in 2021.","records_affected":null,"threat_actor":"BEC networks arrested in Nigeria, South Africa, Canada and Cambodia, plus U.S.-based money laundering cells","summary":"Operation Eagle Sweep, announced by the FBI and Justice Department on March 30, 2022, was a three-month coordinated action against business email compromise networks. It produced 65 arrests, including 12 in Nigeria, eight in South Africa, two in Canada and one in Cambodia, with parallel operations by Australia, Japan and Nigeria. The targeted actors were linked to more than 500 U.S. victims and over $51 million in losses. Cases included a Houston laundering network that moved at least $4.5 million to Nigeria.","how_it_worked":"The disrupted crews used compromised or spoofed business email accounts to insert themselves into payment flows, then requested wires or changed the banking details on invoices, closings and payroll so victims paid criminals instead of counterparties. The same organizations also targeted individuals, especially real estate purchasers and elderly victims, using romance and advance-fee variants that share the same laundering back end. Proceeds were collected in U.S.-based mule accounts, often opened with stolen or synthetic identities, and forwarded to Nigeria and other destinations. Enforcement paired arrests of the fraud operators with prosecutions of the laundering cells to reduce the networks' ability to cash out.","lessons":"Because the same infrastructure serves corporate and consumer variants, banks and businesses benefit most from beneficiary-account verification and rapid kill-chain reporting rather than victim-type-specific controls.","confidence":"Confirmed","sources":[{"title":"Global Operation Disrupts Business Email Compromise Schemes","url":"https://www.fbi.gov/news/stories/coordinated-operation-disrupts-global-bec-schemes-033022","publisher":"Federal Bureau of Investigation"}],"entry_type":"campaign","slug":"2022-operation-eagle-sweep-65-arrests-in-global-bec-disruption","year":2022,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2022-operation-eagle-sweep-65-arrests-in-global-bec-disruption"},{"title":"FTC data: $147.8M in gift card fraud driven by government and business impersonators","date":"2021-12-08","date_precision":"day","victim_org":"US consumers (multi-victim campaign)","sector":"Consumer","country":"United States","primary_vector":"Vishing (Voice Phishing)","secondary_vectors":["Tech Support Scam","Romance / Investment Scam","Fake Job Offer / Recruitment Lure"],"ai_involvement":"No AI reported","ai_notes":"No AI involvement described.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":147800000,"loss_note":"$147.8 million reported lost across 39,263 gift card fraud reports in the first nine months of 2021. Government impersonation accounted for 7,844 reports and $39.6 million; business impersonation for 12,239 reports and $35.5 million.","records_affected":39263,"threat_actor":null,"summary":"An FTC data spotlight published on 8 December 2021 found that consumers filed 39,263 reports of gift card payments to scammers in the first nine months of 2021, with $147.8 million in reported losses. About one in four fraud victims who reported a payment method named gift cards. Target cards accounted for more than twice the losses of any other brand, with a $2,500 median loss, followed by Google Play, Apple, eBay and Walmart. Phone calls were the contact method in 37 percent of cases.","how_it_worked":"A caller impersonating the Social Security Administration, another government agency, or a business such as Amazon or Apple tells the victim that money is owed or that an account has been compromised, and instructs them to resolve it immediately by buying gift cards at a nearby retailer. The victim is kept on the phone throughout the drive and the purchase, which prevents consultation with anyone and lets the scammer coach them past cashier questions with a cover story about buying gifts. At the register the victim reads the card numbers and PINs aloud over the phone, and the value is drained within minutes. Gift cards are attractive because they are irreversible and untraceable.","lessons":"Retail checkout interdiction, where staff are trained and empowered to stop high-value gift card purchases by customers on the phone, is the single highest-yield control at the point of loss.","confidence":"Confirmed","sources":[{"title":"Scammers prefer gift cards, but not just any card will do","url":"https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2021/12/scammers-prefer-gift-cards-not-just-any-card-will-do","publisher":"Federal Trade Commission"}],"entry_type":"benchmark","slug":"2021-ftc-data-147-8m-in-gift-card-fraud-driven-by-government-and-business-imp","year":2021,"loss_kind":"aggregate","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2021-ftc-data-147-8m-in-gift-card-fraud-driven-by-government-and-business-imp"},{"title":"Operation reWired: 281 arrested worldwide in BEC crackdown","date":"2019-09-10","date_precision":"day","victim_org":"Multiple businesses and individuals (global)","sector":"Other","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":["Vendor / Supply Chain Impersonation","Credential Phishing Portal","Romance / Investment Scam"],"ai_involvement":"No AI reported","ai_notes":"No AI or synthetic media reported.","outcomes":["Wire Fraud / Financial Loss","Attempt Blocked","Identity Theft"],"loss_usd":null,"loss_note":"Not a single-victim loss. The four-month operation produced 281 arrests, seized about $3.7 million and disrupted roughly $118 million in fraudulent wire transfers. IC3 reported nearly $1.3 billion in BEC/EAC losses for 2018 alone.","records_affected":null,"threat_actor":"Multiple BEC networks, predominantly Nigeria-based, plus actors in Turkey and Ghana","summary":"Announced on September 10, 2019, Operation reWired was a four-month international action against business email compromise. It resulted in 281 arrests, 74 in the United States and 207 abroad, including 167 in Nigeria, 18 in Turkey and 15 in Ghana. Authorities seized approximately $3.7 million and disrupted around $118 million in fraudulent transfers. One case involved a community college and an energy company that lost about $5 million, of which banks froze roughly $3.6 million.","how_it_worked":"Operators compromised business and personal email accounts through phishing and credential theft, then monitored correspondence to time an intervention around a real pending payment. When a legitimate invoice, payroll run or closing disbursement was in flight, they injected altered banking instructions that appeared to come from the known counterparty. Victims spanned companies, schools, energy firms, seniors and real estate purchasers. Proceeds were funneled through networks of money mules and fictitious identities before being sent overseas. Thirty-nine FBI field offices and partners in nine countries coordinated arrests, seizures and mule warning letters simultaneously to disrupt both the fraud and its laundering infrastructure.","lessons":"Because criminal proceeds move through domestic mule accounts within hours, rapid reporting to the FBI's IC3 Recovery Asset Team is the single most effective control after a diverted payment is discovered.","confidence":"Confirmed","sources":[{"title":"281 Arrested Worldwide in Coordinated International Enforcement Operation Targeting Hundreds of Individuals in Business Email Compromise Schemes","url":"https://www.justice.gov/archives/opa/pr/281-arrested-worldwide-coordinated-international-enforcement-operation-targeting-hundreds","publisher":"U.S. Department of Justice"},{"title":"Operation reWired","url":"https://www.fbi.gov/news/stories/operation-rewired-bec-takedown-091019","publisher":"Federal Bureau of Investigation"},{"title":"74 Arrested in Coordinated International Enforcement Operation Targeting Hundreds of Individuals in Business Email Compromise Schemes","url":"https://www.justice.gov/archives/opa/pr/74-arrested-coordinated-international-enforcement-operation-targeting-hundreds-individuals","publisher":"U.S. Department of Justice"}],"entry_type":"campaign","slug":"2019-operation-rewired-281-arrested-worldwide-in-bec-crackdown","year":2019,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2019-operation-rewired-281-arrested-worldwide-in-bec-crackdown"}]}