What happened
On April 30, 2015 a Mattel finance executive wired $3 million to a bank in Wenzhou, China after receiving an email purporting to come from newly appointed chief executive Christopher Sinclair. The fraud was recognized the same day. Because May 1 was a banking holiday in China, Mattel was able to work with U.S. and Chinese law enforcement and the receiving bank to freeze the account, and the funds were returned within days.
How the deception worked
The attackers studied Mattel's payment approval rule, which required sign-off from two senior managers, and timed their approach to a leadership transition when a new CEO's email habits were unfamiliar. They sent a spoofed request from the incoming chief executive asking for a vendor payment to a new supplier in China, framed as routine business expansion. The finance executive believed the request satisfied the two-approver rule because the CEO himself appeared to be one of the approvers. Only afterward, when she mentioned it to Sinclair, was the fraud exposed. A Chinese public holiday delayed onward movement of the money long enough for law enforcement to freeze it.
AI involvement · No AI reported
No AI or synthetic media reported.
The control that would have caught it· our reading, not a claim from the sources
Approval rules must count only independently verified approvers; a request that supplies its own authorization by email is not dual control, and new-vendor payments deserve a mandatory verification step.
Sources (1)
- Chinese scammers take Mattel to the bank, phishing them for $3 millionCSO Online·csoonline.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.