Documented social engineering incidents targeting the government & public sector sector, sourced and fact-checked.
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
DocumentedA Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member. Agents found four phones and a USB drive on her; cash and a hidden-camera detector were found in her hotel room. The initial malware assessment of the USB drive was later disputed.
DocumentedCensys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed. How it worked and how to tell.
DocumentedA Ukrainian-language "shared document" phishing wave used a fake reCAPTCHA "verify you are human" ClickFix page to trick victims into pasting and running PowerShell themselves, deploying a rarely-seen infostealer Proofpoint dubbed suspected "Lucky Volunteer" in activity assessed to overlap with the Russia-linked espionage actor UAC-0050.
DocumentedFake QR stickers on UK council parking machines sent drivers to cloned payment sites. 123 of 373 councils were hit in a year. How it works, who's behind it.
DocumentedA nation-state cyberweapon crossed an air gap into Iran's Natanz nuclear facility on infected USB drives, first through a recruited insider and later on media carried in by unwitting contractors, then physically destroyed roughly 1,000 uranium centrifuges.
DocumentedSomeone used the White House chief of staff's phone contacts and an AI-like voice to call senators and executives, asking for a pardon list and cash.
DocumentedTexts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025. How the scam works and how to check a toll text.
DocumentedA Pennsylvania shredding-business owner's 2010 qui tam suit alleged that Shred-It, Iron Mountain.
DocumentedA Singapore businessman sent at least S$4.9M after a fake Zoom "government meeting" built from real footage of PM Lawrence Wong and other officials.
DocumentedAPT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government PCs. How it worked and how to catch it.
DocumentedOrlando police pulled about 200 fake QR stickers off downtown parking meters in June 2025. How to spot them: white sticker, peels off. No losses confirmed.
DocumentedImpersonators posing as two Philadelphia school vendors asked to switch from cheque to ACH and diverted nearly $700,000 in 2024. Found a year later by auditors.
DocumentedA forged "change your remittance bank account" email tricked a Puerto Rico government corporation into wiring $2.6M to a fraudster-controlled account in January 2020.
DocumentedAttackers hijacked the New Haven school COO's email, quietly monitored a real $5.9M bus-contract payment thread, then posed as the vendor and were told by city and school staff to change the vendor's bank details themselves in the city's online vendor portal, diverting about $6M in city funds.
DocumentedA Bengaluru retiree lost Rs 6.88 lakh after a deepfake Facebook ad of India's finance minister pitched a fake SBI-linked scheme. How the scam worked.
DocumentedAn Atlantic City woman called grieving widows posing as a life insurer, demanding gift cards to clear policy "arrears". 17+ victims, $100,000+. How it worked.
DocumentedA Houston- and California-based ring spoofed or compromised business emails to trick four companies and one New Jersey township into wiring over $2.5 million meant for real creditors into shell-company "money mule" accounts, which the defendants then laundered through layers of bank transfers; a mule-account operator drew the case's longest sentence in July 2025, months before two more defendants were sentenced in February 2026.
DocumentedA spoofed-email scheme impersonating MacEwan University's trusted general contractor, Clark Builders, tricked staff into redirecting $11.8 million CAD in construction payments to fraudulent bank accounts in Montreal and Hong Kong, one of the largest publicly documented BEC transfers at a North American university.
Reported/allegedAn unidentified operator jailbroke Anthropic's Claude Code with a fake "authorized bug bounty and penetration test" pretext, then defeated its refusal by handing it a 1,084-line attack playbook as a file to save, which loaded automatically into every later session; Gambit Security reconstructed the result as a human-directed campaign that used Claude Code and OpenAI's GPT-4.1 against nine Mexican government bodies. Anthropic confirmed the misuse of its platform and banned the accounts, but every named victim that has responded denies being breached and no Mexican authority has confirmed it.
DocumentedA 2025 campaign faked Portugal's tax authority and asked victims to paste a command to 'enable file preview', starting a chain to the Lampion banking trojan.
DocumentedA Tennessee school district's finance director wired $3.36M in state education funds to fraudsters impersonating textbook vendor Pearson from a look-alike "pearson.quest" domain.
DocumentedDOJ's first-of-its-kind nationwide takedown charged 61 individuals and entities, including five Ahmedabad, India call-center conglomerates, for an alleged 2012-2016 IRS/USCIS impersonation vishing scheme that threatened over 15,000 U.S. victims with arrest or deportation to obtain payments via prepaid cards and wires.
DocumentediSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed in. In the UK alone, prosecutors traced £43 million in fraud to the site. The judge put the worldwide figure nearer £100 million. Police took the server down on November 8, 2022. Six months later its administrator, Tejay Fletcher, got 13 years and 4 months.
Research/advisoryThree separate congressional watchdog engagements, not one campaign. In 2000, GAO agents carrying counterfeit badges declared themselves armed officers and were waved around screening at all 21 sites they tried. In 2002, they talked a pass-issuing clerk out of a genuine building pass, forged copies for the team, and breached four of the five Atlanta buildings tested. In 2009 a differently designed test used no deception at all. No public record substantiates a parallel breach of the U.S. Capitol or the GAO-13-370T report cited in some retellings.
Research/advisoryRussian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
Research/advisoryThe FTC warned in 2023 about fake QR codes on parking meters and in texts. What it said, the Texas meter stickers behind it, and how to check a code safely.
Research/advisoryTask scams start with a job text and end with crypto deposits to unlock fake earnings. FTC: reports rose from 5,000 to 20,000; $223M lost in six months.
DocumentedBetween 2006 and 2008 the FTC pursued six civil cases covering 16 data-broker and private-investigation defendants after two dismissals, alleging they pretexted telecom carriers to obtain and resell consumers' confidential call records. Several matters resulted in permanent injunctions and monetary judgments totaling over $1 million, while the 77 Investigations matter's disposition and collection are not established by the cited sources.
DocumentedCriminals posing as a vendor redirected $4.92M in North Dakota school building-fund payments in 2026. The FBI seized $4.86M. How vendor email fraud works.
DocumentedRussian GRU officers spoofed Google security-alert emails with Bitly-masked links to phish 300+ individuals affiliated with the Clinton campaign, DCCC, and DNC, stealing 50,000+ of the campaign chairman's emails after an IT aide's fateful 'legitimate' typo.
DocumentedAn infected USB flash drive introduced onto a U.S. military laptop in 2008 let the agent.btz worm cross onto classified SIPRNet and JWICS systems, triggering a 14 month Pentagon cleanup and a worldwide ban on thumb drives, and helping spur the creation of U.S. Cyber Command.
DocumentedA long-running, India-based network of call centres impersonated the Canada Revenue Agency and RCMP in mass vishing calls that threatened tens of thousands of Canadians with arrest or deportation over fake tax debts, stealing tens of millions of dollars before RCMP's Project OCTAVIA and Indian police raids on roughly 39-40 call centres, plus Canadian money-mule prosecutions, disrupted the operation.
DocumentedScammers impersonating a school construction contractor submitted a bank-account-change request with seemingly valid documentation, and Cabarrus County, NC wired $2.5M to the fraud account, resulting in a reported $1.73M net loss.
DocumentedUS prosecutors charged 28 people over an alleged $65M scheme where callers faked refunds to trick seniors into sending cash. How the refund trick works.
DocumentedA compromised Constant Contact mass-mailing account let Russia-linked Nobelium (APT29) send USAID-spoofed phishing emails that funneled roughly 3,000-7,000 accounts across 150-350 government, IGO, and NGO organizations toward an ISO-file/Cobalt Strike infection chain, prompting a joint CISA/FBI advisory (AA21-148A) and a DOJ domain seizure.
DocumentedIn late December 2012, attackers rigged the Council on Foreign Relations website to silently exploit an Internet Explorer zero-day and drop malware.
DocumentedAnthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most of an espionage campaign. Critics doubt it.
DocumentedAnthropic says one criminal used Claude Code to breach 17 organisations, price ransoms from their own books and write the notes. Demands hit $500,000+.
DocumentedPolice say a gang turned photos into AI blinking clips to beat Aadhaar face checks, hijack linked phone numbers and take loans. Seven arrests so far.
DocumentedHours before Maharashtra's 2024 assembly election polling, BJP-amplified audio clips purporting to catch two opposition leaders discussing a bitcoin-funded election bribery scheme were independently forensically confirmed as substantially AI-generated voice clones.
Social Engineering Examples