Documented social engineering incidents targeting the consumer / general public sector, sourced and fact-checked.
Fraudsters plastered fake QR-code stickers over genuine PayByPhone parking codes at UK council car parks in Cheltenham, Swindon and Somerset, tricking drivers into paying "parking fees" on cloned sites that harvested full card details or signed them up for hidden subscriptions.
ConfirmedA caller posing as a Standard Bank representative persuaded 18-year-old Reabetswe Modisane to move her R438,900 education trust fund to a "safe" Capitec account, with three transfers completed within 20 minutes; Standard Bank's own investigation attributed the loss to vishing while denying any breach of its systems, and the case has been escalated to the National Financial Ombud and North West police.
ConfirmedA mass SMS phishing campaign impersonating dozens of U.S. toll agencies spoofed 'unpaid toll' notices to harvest payment card and personal data, drawing 2,000+ FBI complaints within weeks of an April 2024 IC3 alert and continuing into 2025; the underlying 'Lighthouse' phishing kit was targeted by a Google civil lawsuit in November 2025.
ConfirmedA Singaporean finance professional in her 50s lost S$1.2 million (~US$900,000) over two months after scammers impersonating an Anti-Scam Centre officer and then police "Inspector Chong" convinced her she was linked to money laundering, coaching her to lie to the real Anti-Scam Centre and extracting funds via bank transfers and four in-person cash handoffs.
ConfirmedA Singaporean businessman transferred at least S$4.9 million after WhatsApp and email lures citing the Strait of Hormuz crisis drew him into a deepfake AI-generated Zoom "government meeting" that appeared to feature PM Lawrence Wong and other senior officials.
ConfirmedScammers impersonating Southern California Edison used real-time-negotiated "pay now or we shut off your power in 30 minutes" phone and in-person threats to extract $131,464 from customers in 2025, a documented 72% drop from 2024 that SCE publicly credited to customer awareness and its recurring scam-education campaigns.
ConfirmedCosta Rica-based telemarketing ringleader Roger Roger used VOIP-spoofed Washington D.C. caller ID and fake government-official personas to convince hundreds of mostly elderly U.S. victims they had won sweepstakes prizes, bilking them of over $4 million before advance-fee "taxes and fees" demands. He was convicted at trial in 2024 and sentenced to over 15 years in 2025.
ConfirmedA joint FBI-Dubai Police-Chinese MPS-Royal Thai Police operation arrested 276+ people and dismantled 9 pig-butchering scam compounds abroad, while a San Diego federal grand jury indicted alleged Ko Thet Company manager/recruiter Thet Min Nyi ("Pixy") and criminal complaints charged three others tied to the Sanduo Group and Giant Company networks.
ConfirmedTwo Quebec fraudsters acting as courier and driver for an AI-voice-cloned "grandchild in crisis" vishing scheme that defrauded Saskatchewan seniors of tens of thousands of dollars were sentenced in Regina provincial court, with the judge explicitly finding AI was used to mimic victims' grandchildren's voices and calling lead defendant Ciprian Teodor "the human face of an otherwise faceless, AI-driven fraud."
ConfirmedP&G-hired competitive-intelligence contractors retrieved roughly 80 unshredded confidential Unilever hair-care documents from the trash before P&G self-disclosed the operation, fired three employees, and settled with Unilever in September 2001.
ConfirmedScammers papered roughly 200 counterfeit QR-code stickers over legitimate ParkMobile decals on downtown Orlando parking meters, redirecting drivers who scanned them to a phishing site that harvested personal and payment information.
ConfirmedScammers impersonating PG&E threaten customers and small businesses with immediate service disconnection, then text or email a barcode/QR code and tell them to have a store cashier scan it to "pay," draining funds instantly through a channel with no fraud checkpoint; PG&E's own fraud investigator quantified over $211,000 in losses through mid-2026.
ConfirmedA Chicago hairstylist wired $20,000 of her own money to scammers after a caller impersonating Bank of America, with a spoofed caller ID matching the real number on the back of her bank card, convinced her a hacker was draining her account and that transferring the funds would "protect" them, a case the FBI cites as a textbook "Phantom Hacker" scam.
ConfirmedA Pakistani national in Sydney allegedly ran a callback-vishing scheme impersonating Optus and TPG Telecom support, tricking 100+ Australians into receiving "maintenance"/upgrade-related SMS one-time PINs that he intercepted to fraudulently buy and reroute high-end phones for offshore resale, netting more than AUD $1 million in seized cash before his November 2024 arrest.
ConfirmedFraudsters hijacked a WhatsApp account via a malicious ZIP file, swapped in their own number while keeping the real display photo of former Rajya Sabha MP Naresh Gujral, and impersonated him to his company's finance staff to push through four RTGS transfers totaling Rs 7.68 crore before Delhi Police froze roughly Rs 4.28 crore and arrested one mule-account holder.
ConfirmedA Bengaluru retiree lost Rs 6.88 lakh after an AI-generated deepfake Facebook video falsely showed Finance Minister Nirmala Sitharaman endorsing a fake SBI/Finance-Ministry-linked investment scheme, with WhatsApp callers from a UK number then upselling him into repeated transfers.
ConfirmedAn Atlantic City woman posed as a life-insurance/retirement-benefit representative on burner-phone calls to recently widowed elderly victims, telling them their late spouse's policy was "in arrears" and draining over $100,000 from them via prepaid gift cards, while separately hiding that income to keep collecting SSI, Medicaid, and HUD housing assistance.
ConfirmedA Russian-speaking threat actor used disposable, one-conversation ChatGPT accounts to iteratively build and debug a Go-based Windows malware family and its C2 server, distributing it through a public repository disguised as the "Crosshair-X" gaming overlay tool, until OpenAI's abuse-detection system caught and dismantled the operation.
ConfirmedA 16-member Colombian crime ring called and WhatsApp-messaged bank customers posing as fraud-prevention officers, talked mostly over-50 victims into sharing their phone screens, and drained COP 1.685 billion from 94 people across 10 departments before a joint Fiscalia-Policia Nacional operation captured the group, including alleged leader alias "Ralf."
ConfirmedA retired New Jersey man lost $390,000 in two days after a fake Norton/PayPal refund call escalated into a bogus PNC "mistaken deposit" story that had him wire his savings to a gold dealer and collect the coins in person, while bank and dealer staff watched him stay on the phone the whole time.
ConfirmedA retired 60-year-old Malaysian bank manager in Johor Baru lost RM936,000 (life savings) after a Macau-scam vishing syndicate posing successively as an insurance agent, a police officer, and a deputy public prosecutor convinced her to open a new bank account, transfer her savings into it, and hand over her online banking credentials "for investigation," only for the funds to be drained before she discovered the theft on 15 May 2026.
ConfirmedDOJ's first-of-its-kind nationwide takedown charged 61 defendants and five Ahmedabad, India call-center conglomerates for a 2012-2016 IRS/USCIS impersonation vishing scheme that threatened over 15,000 U.S. victims with arrest or deportation to extort payment via prepaid cards and wires.
ConfirmedImperva researcher Yohann Sillam showed that whitespace-padded prompt-injection payloads hidden in WhatsApp contact names, vCard FN fields, and geolocation pin labels, invisible to victims because OpenClaw's UI truncated the fields, could make the OpenClaw AI agent silently fetch and execute an attacker-hosted setup.py, a flaw OpenClaw patched in v2026.4.23.
ConfirmedThe FTC's first major consumer alert on QR-code scams (Dec 6, 2023) warned of fake QR stickers on parking meters and phishing emails/texts using QR codes to steal credentials or install malware.
ConfirmedA victim searching for the AnyDesk remote-access tool hit a typosquatted site with a fake Cloudflare Turnstile that, instead of the usual ClickFix paste-and-run trick, abused the Windows search-ms protocol to pull a disguised LNK/PDF from an attacker SMB share, ultimately installing an MSI that fingerprinted the host and dropped the MetaStealer infostealer.
ConfirmedA convincing fake ChatGPT download site, openew[.]app -- reached in part via an AI-generated fake outage page rendered on a real chatgpt.com/s/ URL -- used malvertising and SEO poisoning to push Windows visitors to a credential-stealing loader and Mac visitors to Odyssey Stealer (an AMOS/Atomic Stealer fork) that also swapped in trojanized Ledger and Trezor wallet apps.
ConfirmedThe FBI's IC3 issued a December 2024 public advisory detailing how criminals use AI-generated text, images, voice cloning, and deepfake video to make fraud schemes, including loved-one crisis scams and bank-account impersonation, more scalable and believable.
ConfirmedThe FBI, FTC, and USPIS each issued 2025 public warnings about "brushing 2.0" -- unsolicited packages containing QR codes that, when scanned, send recipients to phishing sites or malware instead of the promised gift-sender reveal or return instructions.
ConfirmedIn June 2025 the DOJ filed a civil forfeiture complaint against more than $225.3M in Tether (USDT) traced to a global pig-butchering money-laundering network, the largest crypto seizure in U.S. Secret Service history and the biggest tied to crypto confidence scams.
ConfirmedA Dominican Republic call-center network ran a multi-role "grandparent"/"family-in-need-of-bail" scam: openers posed as a distressed grandchild, closers posed as defense attorneys, police, or court staff, and in-person couriers collected cash, bilking hundreds of elderly Americans out of millions of dollars.
ConfirmedA Brighton-area kitchen fitter lost roughly £76,000, including four loans he was pressured into taking out, after a Facebook ad using deepfaked video of Martin Lewis and Elon Musk lured him into a fake bitcoin investment run through a fraudulent Revolut account.
ConfirmedAttackers later attributed to Scattered Spider (a group representative initially denied involvement) social-engineered Caesars Entertainment's outsourced IT support vendor, since identified in litigation as Coforge, into resetting credentials, stole the Caesars Rewards loyalty database (SSNs and driver's license numbers), and Caesars reportedly paid roughly $15 million to keep the data private. It was disclosed in an SEC 8-K days before the parallel MGM Resorts breach by the same actor.
ConfirmedDOJ/IRS-CI unsealed four indictments charging 28 members of a Chinese organized-crime money-laundering ring tied to India-based "mistaken refund" call-center scams that stole $65 million from thousands of US seniors, cracking the case partly with help from YouTube scambaiters who filmed and identified key money mules.
ConfirmedDOJ/FTC alleged that Citizens Disability and subsidiary CD Media made 109 million-plus illegal telemarketing calls, including 25.7 million-plus to Do-Not-Call Registry numbers, using robocalls voiced by "Amber" or "Audrey" that falsely told consumers they were following up on the consumer's own SSDI eligibility inquiry.
ConfirmedA long-running, India-based network of call centres impersonated the Canada Revenue Agency and RCMP in mass vishing calls that threatened tens of thousands of Canadians with arrest or deportation over fake tax debts, stealing tens of millions of dollars before RCMP's Project OCTAVIA and Indian police raids on roughly 39-40 call centres, plus Canadian money-mule prosecutions, disrupted the operation.
ConfirmedA Taiwan-linked money courier was caught in an Austin bank sting after helping collect part of the $1,408,850 a local victim lost over six months to a "pig butchering" romance-investment scam run through the LINE app and a fake "DAIQ" crypto trading platform.
ConfirmedGhanaian social-media personality Frederick Kumi ("Abu Trica") and co-defendant Daniel Yussif were federally indicted for leading a romance-fraud network that allegedly used AI-generated personas and AI-driven video platforms to defraud 80+ elderly Americans of more than $8 million between 2023 and 2025.
ConfirmedDOJ alleges Ghanaian twins Jamal and Kamal Abubakari and U.S.-based Amanda Opoku-Boachie ran an AI-video-enabled romance fraud ring that used fictitious female personas to defraud 130+ older Americans of $15 million+ between 2024 and 2026.
Social Engineering Examples