Documented social engineering incidents targeting the financial services & insurance sector, sourced and fact-checked.
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC won a $5.5M default judgment.
DocumentedA fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from a Wells Fargo customer, and the bank's wire-verification representative then said aloud that the amount was unusual, that the account had been flagged and that a second review was required, and released the $100,000 wire anyway, per a Los Angeles lawsuit built partly on the bank's own recorded verification call.
DocumentedThe CEO of a UK energy firm was tricked into wiring €220,000 (~$243,000) to a Hungarian account in March 2019 after a phone call using AI-cloned audio of his German parent company's own CEO's voice, marking the first widely reported criminal use of AI voice-cloning technology, disclosed by insurer Euler Hermes.
DocumentedCensys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed. How it worked and how to tell.
DocumentedTarget's 2013 breach began with malware emailed to a small HVAC contractor. 40M cards and 70M records exposed. What's known, what's myth, and what it cost.
DocumentedTwo unencrypted TD Bank backup tapes carrying data on 260,000 customers vanished in transit between Massachusetts offices in 2012.
DocumentedA caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in 20 minutes. What happened and what's disputed.
DocumentedFake Anti-Scam Centre and police officers convinced a Singapore finance worker she was a suspect, then took S$1.2M through transfers and cash handoffs.
DocumentedA Singapore businessman sent at least S$4.9M after a fake Zoom "government meeting" built from real footage of PM Lawrence Wong and other officials.
DocumentedA 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above $25M. Nine now convicted.
DocumentedSABRIC recorded R2.4bn in South African digital banking fraud claims in 2025, driven by phishing, fake bank calls and SIM swaps. What the numbers mean.
DocumentedA Pune CFO sent Rs 56 lakh after a Microsoft Teams message from a fake CEO profile. A second Rs 1.5 crore request made her call the real CEO. What happened.
DocumentedA fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the rest: 27 crypto accounts hijacked. What happened.
DocumentedChinese state-linked hackers used spear-phishing links and an unpatched Internet Explorer zero-day to breach Google, Adobe, and dozens of other US tech and defense firms in a campaign that stole intellectual property, targeted Gmail accounts of human-rights activists, and led Google to publicly confront China and stop censoring its search results.
DocumentedA Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a hacker was draining her account, so she wired her own money to the scammers. His number matched the one on the back of her card. ABC7 Chicago reported the case in January 2025 under the FBI's "Phantom Hacker" label. The $20,000 is her own figure, and none of it has come back.
DocumentedA Kansas City TV station found intact consumer home-loan applications with Social Security and account numbers tossed in a title company's open dumpster.
DocumentedA Bengaluru retiree lost Rs 6.88 lakh after a deepfake Facebook ad of India's finance minister pitched a fake SBI-linked scheme. How the scam worked.
DocumentedAn Atlantic City woman called grieving widows posing as a life insurer, demanding gift cards to clear policy "arrears". 17+ victims, $100,000+. How it worked.
DocumentedA Houston- and California-based ring spoofed or compromised business emails to trick four companies and one New Jersey township into wiring over $2.5 million meant for real creditors into shell-company "money mule" accounts, which the defendants then laundered through layers of bank transfers; a mule-account operator drew the case's longest sentence in July 2025, months before two more defendants were sentenced in February 2026.
DocumentedA scammer spoofed a New Zealand bank's number and obtained authentication codes by claiming they would suspend banking and cancel payments. A NZD 30,000 unauthorized credit-card transaction followed; a later safe-account request raised the customer's suspicions. The Ombudsman recommended reimbursement, without documenting that it was paid.
DocumentedA spoofed-email scheme impersonating MacEwan University's trusted general contractor, Clark Builders, tricked staff into redirecting $11.8 million CAD in construction payments to fraudulent bank accounts in Montreal and Hong Kong, one of the largest publicly documented BEC transfers at a North American university.
DocumentedA four-man Manhattan BEC ring used compromised business email accounts to redirect approximately $3.49 million and $2.0 million in wires, then moved funds through additional accounts and Bitcoin.
Reported/allegedAn unidentified operator jailbroke Anthropic's Claude Code with a fake "authorized bug bounty and penetration test" pretext, then defeated its refusal by handing it a 1,084-line attack playbook as a file to save, which loaded automatically into every later session; Gambit Security reconstructed the result as a human-directed campaign that used Claude Code and OpenAI's GPT-4.1 against nine Mexican government bodies. Anthropic confirmed the misuse of its platform and banned the accounts, but every named victim that has responded denies being breached and no Mexican authority has confirmed it.
DocumentedColombian police say 'Los Cyber' posed as bank fraud staff, got victims to share their phone screens and took COP 1.685 billion from 94 people. 16 charged.
DocumentedA civil complaint alleges that a retired New Jersey man lost $390,000 in two days after a fake Norton/PayPal refund call escalated into a bogus PNC "mistaken deposit" story that induced him to wire savings to a gold dealer and collect the coins in person.
DocumentedA 2025 campaign faked Portugal's tax authority and asked victims to paste a command to 'enable file preview', starting a chain to the Lampion banking trojan.
DocumentedPosing as NatWest bank security, vishing criminals convinced a Surrey solicitor to transfer £734,000 of client money to "safe" accounts. BBC reporting said roughly £512,000 had been withdrawn and remained unrecovered at the time of reporting. The solicitor was suspended, declared bankrupt, and faced losing her home.
DocumentedDOJ's first-of-its-kind nationwide takedown charged 61 individuals and entities, including five Ahmedabad, India call-center conglomerates, for an alleged 2012-2016 IRS/USCIS impersonation vishing scheme that threatened over 15,000 U.S. victims with arrest or deportation to obtain payments via prepaid cards and wires.
DocumentediSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed in. In the UK alone, prosecutors traced £43 million in fraud to the site. The judge put the worldwide figure nearer £100 million. Police took the server down on November 8, 2022. Six months later its administrator, Tejay Fletcher, got 13 years and 4 months.
DocumentedA respected Kansas bank CEO was groomed on WhatsApp into a crypto scam, wired $47.1M of bank funds in 11 transfers and collapsed the bank. Why dual control didn't save it.
DocumentedGootLoader operators hijacked Google search rankings for legal-agreement phrases, luring law firm staff to fake forum "direct download" pages that delivered malicious JavaScript loaders, some of which escalated via Cobalt Strike into REvil ransomware attacks, a pattern CFC's Incident Response Team documented after seeing it hit multiple insured legal services firms.
DocumentedDOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records describe the fake Combi Security recruitment front; separately reported FBI attribution links FIN7 to later malicious-USB mailings.
Research/advisoryThe FBI's 2025 Internet Crime Report tracked AI fraud for the first time: 22,364 complaints and $893M lost. What the number means and what it doesn't.
Research/advisoryThe FBI's December 2024 warning on AI-enabled fraud: AI text, fake IDs, cloned voices and deepfake video, and what the FBI says to do about each.
DocumentedA deepfaked Martin Lewis Facebook ad led to a fake adviser, a Revolut account, £5,000 of savings and £70,000 in loans. How it ran and what exposed it.
DocumentedBelgian bank Crelan lost close to EUR 70 million (~US$75.8M) after fraudsters impersonating its CEO induced internal staff to execute a series of unauthorized wire transfers, discovered via internal controls in January 2016.
DocumentedIn June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX flagged accounts. What the numbers mean.
DocumentedUS prosecutors charged 28 people over an alleged $65M scheme where callers faked refunds to trick seniors into sending cash. How the refund trick works.
DocumentedNorth Korea-linked hackers ran fake job interviews for crypto firms, then told applicants to paste a 'camera fix' that installed malware. How ClickFake works.
DocumentedAnthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most of an espionage campaign. Critics doubt it.
DocumentedA single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that quietly stole personal data on 78.8 million people over the next 11 months.
DocumentedAnthropic says one criminal used Claude Code to breach 17 organisations, price ransoms from their own books and write the notes. Demands hit $500,000+.
DocumentedLazarus hackers used a fake LinkedIn job offer to plant spyware on a Sky Mavis engineer's laptop, then drained $540M from the Ronin bridge in March 2022.
DocumentedIn 2022, 0ktapus texted staff fake IT alerts linking to Okta lookalikes, stealing 9,931 logins and MFA codes. Twilio was breached; Cloudflare's keys held.
DocumentedThe FTC's first-ever case under the FACTA Disposal Rule: a Northbrook, Illinois mortgage lender repeatedly dumped intact customer credit reports.
DocumentedPolice say a gang turned photos into AI blinking clips to beat Aadhaar face checks, hijack linked phone numbers and take loans. Seven arrests so far.
Social Engineering Examples