AFGlobal Corp. $480K CEO-impersonation wire fraud (2014)

What happened

In May 2014, AFGlobal alleged that its director of accounting received emails purporting to come from the company's CEO and assigning a "strictly confidential financial operation" tied to a supposed acquisition in China. The messages directed the employee to coordinate only with the CEO and a purported KPMG attorney and invoked SEC regulations to discourage discussion. According to the allegations reproduced by Krebs on Security, the purported attorney followed up by phone and email with instructions for a $480,000 transfer to an Agricultural Bank of China account. A later request for $18 million prompted suspicion and was not paid. AFGlobal filed an insurance claim, Federal Insurance denied coverage, and AFGlobal sued. The cited docket index records a dismissal with prejudice on February 6, 2017, but does not establish settlement terms, a payment, or a merits ruling. The attacker was not publicly identified in the cited reporting.

How it worked

The reported scheme used two claimed sources of authority: emails purporting to come from the CEO and phone and email communications from a purported outside attorney. The messages invoked authority, urgency, confidentiality, and SEC compliance to discourage independent verification. AFGlobal alleged that the imposter appeared familiar with company procedures and the existing relationship between the executive and accounting director; this remains a party allegation rather than proof of how the attacker obtained that knowledge.

The lure and the tell

Lure: an email from the "CEO" naming a confidential deal ("manage file T521"), directing the employee to work only with the CEO and a named attorney and to keep silent to avoid SEC issues, followed by phone-and-email wire instructions from the fake attorney. Tells: the demand for secrecy and single-channel communication (a deliberate block on verification), pressure and urgency around a large wire to a foreign bank, an unusual acquisition/due-diligence narrative, and ultimately the escalation to an implausible $18M request. Any of these should trigger independent, out-of-band verification of the executive and the payment.

Outcome

The $480,000 transfer was reported as unrecovered, while the later $18 million request was not paid. Federal Insurance denied AFGlobal's claim, disputing coverage under the cited policy provisions, and AFGlobal sued for breach of contract and bad faith. The cited docket index records termination on February 6, 2017 following a stipulation of dismissal with prejudice. That procedural disposition does not itself disclose a settlement, payment, or merits determination.

Why it matters

The case is a documented example of an employee-authorized BEC transfer followed by a coverage dispute. It illustrates two practical risks: social engineering can induce an authorized employee to initiate a transfer, and reimbursement depends on the terms and application of the relevant insurance policy. The dismissal with prejudice does not establish a judicial ruling on those coverage questions.

Defenses

Require out-of-band verification (a call-back to a known number, not one supplied in the email) for any wire request, especially urgent, confidential, or executive-initiated ones. Treat demands for secrecy and single-channel communication as red flags, not compliance. Enforce dual authorization and a callback threshold for large or foreign wires. Train finance staff that authority, urgency, and secrecy together are the classic BEC pattern, and that even a familiar executive's request must be verified. Use email authentication (SPF/DKIM/DMARC) and external-sender/look-alike-domain warnings. Confirm in advance which insurance policy, if any, covers social-engineering fraud, since standard cyber/crime coverage often excludes voluntarily-authorized transfers.