FACC "Fake President" CEO fraud drains ~EUR 42M from Austrian aerospace supplier

What happened

On January 19, 2016, FACC AG disclosed via an ad-hoc regulatory statement (it is listed on the Vienna Stock Exchange) that it had become the victim of "fraudulent activities involving communication and information technologies." The financial accounting department of subsidiary FACC Operations GmbH was the target of what FACC itself later termed the "Fake President Incident." Attackers impersonating CEO Walter Stephan sent email instructions requesting a large transfer of funds for a purported acquisition/project. Staff wired approximately EUR 50M (nearly 10% of annual revenue). FACC stressed that its IT infrastructure, data security, IP rights and operational business were not compromised, and that no malware was involved: this was a social-engineering/deception fraud, not a system breach. FACC filed a criminal complaint and launched a forensic investigation. It managed to block EUR 10.9M in recipient accounts, resulting in a net one-time charge of EUR 41.9M. The company fired its CFO (Minfen Gu) in February 2016 and dismissed CEO Walter Stephan, a 17-year veteran, with immediate effect on May 24, 2016, concluding he had "severely violated his duties, in particular in relation to the Fake President Incident." Facts are drawn from FACC's own ad-hoc disclosures and corroborated by Reuters, Bloomberg and trade press.

How it worked

This was a Business Email Compromise / CEO fraud (also called "fake president," "bogus boss," or whaling). Rather than exploiting a technical vulnerability, the fraudsters exploited organizational trust: they crafted email(s) appearing to come from the CEO instructing finance staff to transfer money for a confidential, time-sensitive acquisition project. FACC confirmed no malware and no IT-system breach was found, underscoring that the attack succeeded through impersonation and manipulation of authority rather than hacking. The request routed around normal scrutiny because it appeared to carry executive authority and framed the transfer as an urgent, legitimate business deal.

The lure and the tell

Lure: an email purporting to be from the CEO directing accounting staff to wire funds for a fake acquisition/project, leveraging executive authority, urgency and confidentiality. Tells (in hindsight): a payment request that bypasses standard authorization and dual-control procedures; unusually large, out-of-pattern transfer to a new/external account; a "confidential deal" framing that discourages verification; and instructions arriving only by email without independent, out-of-band confirmation from the named executive.

Outcome

Audited one-time charge of EUR 41.9M after EUR 10.9M of the EUR 52.8M transferred was frozen. FACC's share price fell sharply (roughly 17% on disclosure). The CFO was fired in February 2016 and the CEO on May 24, 2016; Robert Machtlinger was appointed interim CEO. FACC pursued insurance claims and civil recovery, and both threads are now resolved. It sued both former executives for damages, initially EUR 10M and later raised to EUR 43M. The Regional Court in Ried dismissed the claim in 2019 and Austria's Supreme Court rejected it finally on 3 August 2021 (8 ObA 109/20t), finding no breach of duty and therefore no personal liability; FACC and the former CEO settled confidentially in 2022. Separately, the EUR 10.8M frozen in Chinese accounts in early 2016 was transferred to the Higher Regional Court of Vienna in 2019 and returned to FACC at the end of March 2025. The remaining EUR 41.9M was never recovered. The originating fraudsters were never publicly identified, though Austrian police announced in August 2016 that a 32-year-old Chinese national, an authorised signatory of a Hong Kong company that received about EUR 4M of the proceeds, had been arrested in Hong Kong on 1 July 2016 on money-laundering suspicion.

Why it matters

FACC is one of the most-cited, best-documented BEC/CEO-fraud cases because the victim publicly disclosed it as a listed company, quantified the loss, and took the rare step of firing both its long-serving CEO and its CFO. It shows that a pure social-engineering attack, with no malware and no system breach, can inflict eight-figure damage on a sophisticated global manufacturer, and that finance controls (payment authorization, dual approval, out-of-band verification) matter more than perimeter security against this threat. It also shows that dismissal and legal liability are separate questions. FACC removed both its CEO and CFO, but Austria's Supreme Court later held that the CEO had committed no breach of duty and owed nothing, so the case is a poor authority for the proposition that executives are personally liable for wire-fraud control failures. The nine-year wait to recover the frozen tranche is the other operational lesson: even a fast freeze is not a fast clawback.

Defenses

Require out-of-band verification (a call-back to a known number, not one supplied in the email) for any executive-initiated or large/unusual wire. Enforce dual authorization and segregation of duties for payments above a threshold. Treat "confidential, urgent" transfer requests as a red flag and empower staff to pause and verify without fear of contradicting an executive. Deploy email authentication (SPF/DKIM/DMARC) and flag external/look-alike senders. Train finance teams specifically on CEO-fraud/BEC patterns and run simulations. Maintain fraud-response and recovery playbooks (rapid bank recall requests can freeze funds, as FACC's EUR 10.9M block showed).