Documented cases attributed to organized crime threat actors, sourced and fact-checked.
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC won a $5.5M default judgment.
DocumentedA phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
DocumentedA Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push prompts, then posed as tech support to get one approved, opening the door to Uber's internal network.
DocumentedFake QR stickers on UK council parking machines sent drivers to cloned payment sites. 123 of 373 councils were hit in a year. How it works, who's behind it.
DocumentedA phishing email tricked Unatrac's CFO into surrendering his Office365 credentials on a fake Microsoft login page; the attacker then used the live CFO mailbox to send about 15 fake-invoice wire requests over nine days, draining nearly $11 million overseas.
DocumentedCensys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed. How it worked and how to tell.
DocumentedFraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series of conference calls about a fake confidential China acquisition to talk the Indian subsidiary's head into wiring $18.6 million to Hong Kong accounts in November 2018.
DocumentedTexts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025. How the scam works and how to check a toll text.
DocumentedA 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above $25M. Nine now convicted.
DocumentedFake Anti-Scam Centre and police officers convinced a Singapore finance worker she was a suspect, then took S$1.2M through transfers and cash handoffs.
DocumentedA Singapore businessman sent at least S$4.9M after a fake Zoom "government meeting" built from real footage of PM Lawrence Wong and other officials.
DocumentedDubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters. What is known.
DocumentedSABRIC recorded R2.4bn in South African digital banking fraud claims in 2025, driven by phishing, fake bank calls and SIM swaps. What the numbers mean.
DocumentedA Costa Rica-based telemarketing ringleader used VOIP-spoofed Washington D.C. caller ID and fake government-official personas to convince hundreds of mostly elderly U.S. victims they had won sweepstakes prizes, bilking them of over $4 million before advance-fee "taxes and fees" demands. The lead defendant was convicted at trial in 2024 and sentenced to over 15 years in 2025.
DocumentedA judge called it an AI-driven fraud, but police couldn't confirm voice cloning. How the Saskatchewan grandparent scam worked and how a lawyer's call cracked it.
DocumentedEvaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam worked and what came back.
DocumentedFraudsters spoofing the French CEO's "personal" email talked Pathé's Dutch management into wiring €19.2M for a fake secret Dubai acquisition, costing two executives their jobs.
DocumentedA Pakistan national in Sydney allegedly ran a vishing scheme impersonating telecommunications support, using maintenance or upgrade pretexts to obtain SMS one-time PINs and fraudulently buy and reroute high-end phones for offshore resale. The investigation identified more than 100 Australian victims, and investigators allegedly found more than AUD $1 million in cash at his home during the November 2024 operation.
DocumentedFraudsters swapped a former MP's number in his company's phone but kept his photo, then ordered Rs 7.68 crore in transfers on WhatsApp. How it worked.
DocumentedA tech-support operator used fake Microsoft/Apple security pop-ups to scare consumers, often older Americans, into calling an India-based support line that sold bogus multi-year tech-support packages, resulting in a partially suspended $4.9M FTC judgment plus a separate DOJ prosecution and prison sentence for the operator.
DocumentedA Houston- and California-based ring spoofed or compromised business emails to trick four companies and one New Jersey township into wiring over $2.5 million meant for real creditors into shell-company "money mule" accounts, which the defendants then laundered through layers of bank transfers; a mule-account operator drew the case's longest sentence in July 2025, months before two more defendants were sentenced in February 2026.
DocumentedA four-man Manhattan BEC ring used compromised business email accounts to redirect approximately $3.49 million and $2.0 million in wires, then moved funds through additional accounts and Bitcoin.
DocumentedMGM Resorts, September 2023. A caller reportedly talked the IT help desk into resetting an employee's access, and the shutdown that followed knocked about $100 million off quarterly property profit. No ransom was paid. Below: what MGM's filings confirm, and what only the attackers said. A documented incident.
DocumentedIn March 2022, LAPSUS$ (DEV-0537) leaked an archive it said held 37GB of Microsoft source code. Microsoft only confirmed that one account was compromised, with limited access and no customer code or data involved. It has never put a figure on the loss. A documented incident.
DocumentedColombian police say 'Los Cyber' posed as bank fraud staff, got victims to share their phone screens and took COP 1.685 billion from 94 people. 16 charged.
DocumentedA 2025 campaign faked Portugal's tax authority and asked victims to paste a command to 'enable file preview', starting a chain to the Lampion banking trojan.
DocumentedA retired bank manager in Johor Baru lost RM936,000 after callers posing as an insurer, police and a prosecutor had her move her savings. How Macau scams work.
DocumentedPosing as NatWest bank security, vishing criminals convinced a Surrey solicitor to transfer £734,000 of client money to "safe" accounts. BBC reporting said roughly £512,000 had been withdrawn and remained unrecovered at the time of reporting. The solicitor was suspended, declared bankrupt, and faced losing her home.
DocumentedFraudsters posing as RBS fraud-team staff talked Hamilton Academical FC's sole authorised banking employee into moving nearly £1 million into 26 "safe" accounts over two days in October 2017, leaving the club with a reported outstanding loss of roughly £800,000 after partial recovery and prompting plans to pursue RBS over its duty of care.
DocumentedA respected Kansas bank CEO was groomed on WhatsApp into a crypto scam, wired $47.1M of bank funds in 11 transfers and collapsed the bank. Why dual control didn't save it.
DocumentedDOJ's first-of-its-kind nationwide takedown charged 61 individuals and entities, including five Ahmedabad, India call-center conglomerates, for an alleged 2012-2016 IRS/USCIS impersonation vishing scheme that threatened over 15,000 U.S. victims with arrest or deportation to obtain payments via prepaid cards and wires.
DocumentediSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed in. In the UK alone, prosecutors traced £43 million in fraud to the site. The judge put the worldwide figure nearer £100 million. Police took the server down on November 8, 2022. Six months later its administrator, Tejay Fletcher, got 13 years and 4 months.
DocumentedGootLoader operators hijacked Google search rankings for legal-agreement phrases, luring law firm staff to fake forum "direct download" pages that delivered malicious JavaScript loaders, some of which escalated via Cobalt Strike into REvil ransomware attacks, a pattern CFC's Incident Response Team documented after seeing it hit multiple insured legal services firms.
DocumentedeSentire's Threat Response Unit says it shut down 10 attacks on six unnamed law firms across January and February 2023, from two separate campaigns: SEO-poisoned fake "agreement" downloads delivering GootLoader, and a compromised Notary Public website serving a fake Chrome update to deliver SocGholish to law firm employees and other business professionals.
DocumentedFIN7 (Carbanak) mailed USPS packages containing BadUSB hardware implants to HR, IT, and executive staff at US retail, restaurant, and hotel companies, aiming to trigger automatic malware installation the moment a curious employee plugged the device in; the one package researchers recovered carried a forged Best Buy gift-card letter, a brand the FBI never named.
DocumentedDOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records describe the fake Combi Security recruitment front; separately reported FBI attribution links FIN7 to later malicious-USB mailings.
DocumentedBetween 2006 and 2008 the FTC pursued six civil cases covering 16 data-broker and private-investigation defendants after two dismissals, alleging they pretexted telecom carriers to obtain and resell consumers' confidential call records. Several matters resulted in permanent injunctions and monetary judgments totaling over $1 million, while the 77 Investigations matter's disposition and collection are not established by the cited sources.
Research/advisoryTask scams start with a job text and end with crypto deposits to unlock fake earnings. FTC: reports rose from 5,000 to 20,000; $223M lost in six months.
DocumentedA US Attorney's Office (EDVA) court order seized seven domains spoofing the Singapore International Monetary Exchange that pig-butchering scammers used to defraud five US victims of over $10 million after grooming them via dating apps, social media, and messaging platforms.
DocumentedBelgian bank Crelan lost close to EUR 70 million (~US$75.8M) after fraudsters impersonating its CEO induced internal staff to execute a series of unauthorized wire transfers, discovered via internal controls in January 2016.
DocumentedIn June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX flagged accounts. What the numbers mean.
DocumentedProsecutors say a grandparent scam run from call centers in the Dominican Republic hit hundreds of elderly Americans and took millions of dollars. One caller played a grandchild under arrest. Then a fake lawyer, police officer, or court clerk took over, and couriers in the US picked up the cash. Sixteen people were charged in 2024. Nothing's been proven in court, and there's no itemized loss total anywhere.
DocumentedDOJ/FTC alleged that Citizens Disability and subsidiary CD Media made 109 million-plus illegal telemarketing calls, including 25.7 million-plus to Do-Not-Call Registry numbers, using robocalls voiced by "Amber" or "Audrey" that falsely told consumers they were following up on the consumer's own SSDI eligibility inquiry.
DocumentedIn August 2023, Clorox says, someone phoned its outsourced Cognizant help desk pretending to be two different employees. Agents reset their passwords and MFA, phone number for SMS codes included, without checking who was calling. Operations were disrupted for weeks. Clorox wants $380 million from Cognizant. That's a claim, not a proven loss, and a March 25, 2026 ruling let three of its four claims go ahead.
DocumentedA long-running, India-based network of call centres impersonated the Canada Revenue Agency and RCMP in mass vishing calls that threatened tens of thousands of Canadians with arrest or deportation over fake tax debts, stealing tens of millions of dollars before RCMP's Project OCTAVIA and Indian police raids on roughly 39-40 call centres, plus Canadian money-mule prosecutions, disrupted the operation.
DocumentedThe Caesars breach began in August 2023, when someone called its outsourced IT help desk, said they were an employee, and got a password reset. Soon after, the Caesars Rewards database was stolen. Caesars reportedly paid about $15 million, but its SEC filing never puts a number on it. A documented incident, attributed to Scattered Spider.
DocumentedA caller posing as Carnival's IT security team got an employee's login in April 2026. The attacker copied data on nearly 6 million people. What was taken.
DocumentedUS prosecutors charged 28 people over an alleged $65M scheme where callers faked refunds to trick seniors into sending cash. How the refund trick works.
DocumentedAn Austin man lost $1,408,850 to a fake DAIQ crypto platform found on LINE. A staged $40,000 handoff led police to a 34-year-old courier. How it worked.
DocumentedIn 2022, 0ktapus texted staff fake IT alerts linking to Okta lookalikes, stealing 9,931 logins and MFA codes. Twilio was breached; Cloudflare's keys held.
DocumentedProsecutors allege a Ghana-based network used fake female personas, AI video and inheritance stories to take $8M+ from 80+ elderly Americans.
DocumentedProsecutors allege Ghanaian twins used fake female personas and AI video to take $15M+ from 130+ older Americans. What is alleged and what isn't known.
DocumentedPolice say a gang turned photos into AI blinking clips to beat Aadhaar face checks, hijack linked phone numbers and take loans. Seven arrests so far.
DocumentedGootloader went quiet in the spring of 2025, the tracking researcher telling BleepingComputer his abuse reports caused the operation to cease on March 31, and returned on November 5, 2025 with a lure page that redraws for visitors who pass its gates into an impersonation of a real institution built from Cyrillic lookalike letters, a glyph-swapping WOFF2 web font that keeps malicious filenames out of the page source, and a deliberately malformed ZIP that the built-in Windows extractor turns into a working JScript loader while 7-Zip, WinRAR, Python and VirusTotal either fail on it or produce a .txt of the same name, spread over 100 websites and thousands of keywords, feeding the Supper SOCKS5 backdoor and, via Storm-0494 and Vanilla Tempest, ransomware staging.
Social Engineering Examples