Fraudsters spoofing the French CEO's "personal" email talked Pathé's Dutch management into wiring €19.2M for a fake secret Dubai acquisition, costing two executives their jobs.
Reviewed by the Social Engineering Examples team.
In March 2018, criminals impersonating Marc Lacan, CEO of French parent Pathé, emailed the two-person senior management of Pathé's Dutch subsidiary (managing director Dertje Meijer and CFO Edwin Slutter). Using an address the scammers presented as Lacan's "personal" email, they claimed Pathé was carrying out a strictly confidential acquisition of a company in Dubai and needed urgent payments that would be reimbursed at month's end. Believing they were serving a secret, board-sanctioned deal, the executives authorized a series of wire transfers to an account in the name of Towering Stars General Trading LLC in Dubai, starting at €826,521 on March 9 and escalating through payments of roughly €2.48M, €5M, €5.83M and €5.15M, totaling €19,244,304 by March 27. When the Dutch unit ran short, it drew on the French group's central "cash pool." The fraud was exposed on March 28 when the real Paris headquarters queried the cash-pool withdrawals. Both executives were suspended, then dismissed in April. The details became public through an Amsterdam District Court ruling of October 31, 2018 in Slutter's wrongful-dismissal suit; an internal probe found no employee was knowingly involved in the fraud. This is a real, court-documented incident.
A classic CEO-fraud/BEC pattern with a twist: instead of a fake CEO pressuring a subordinate CFO, the attackers impersonated the French parent's top leadership to instruct an entire overseas subsidiary's management. Opening emails asked innocuous questions (whether KPMG had been in touch) to build a plausible business context before introducing the money request. They leaned on authority (instructions ostensibly from the group's two most senior people), manufactured secrecy ("strictest confidentiality," reply only to the personal address, to keep a competitive edge and avoid disclosure), and legitimacy props (an invoice, a document bearing the CEO's and family shareholders' names/signatures, and claimed KPMG oversight). Requests to phone or involve the supervisory board were deflected as against "KPMG standards," keeping victims inside a channel the attackers controlled. Amounts started small and escalated once trust was established, and the promise of repayment reframed the outflows as temporary. The subsidiary had no fraud training or verification protocol, so requests that felt "strange" were still executed.
Lure: emails from the "personal" account of the parent-company CEO announcing a secret, time-sensitive Dubai acquisition, with instructions to pay tranches to a third-party account and keep it confidential. Tells: a superior demanding payments unrelated to the local entity's business; insistence on secrecy and email-only contact while refusing phone calls or board involvement; a "personal" (non-corporate) email address; funds going to an unrelated third-party company abroad; escalating amounts; and the executives' own instincts: Meijer wrote "Strange, is it not?" and Slutter replied "Curious process. Never experienced anything like that," instincts that were overridden rather than acted upon.
Pathé lost €19.2M. Both Dutch executives were fired in April 2018. Slutter sued for wrongful dismissal; on October 31, 2018 the Amsterdam District Court ruled his summary (on-the-spot) dismissal was not justified and ordered Pathé to pay his salary (~€13,503/month) through December 1, 2018, but still allowed the employment contract to be dissolved for culpable conduct, finding trust had irreparably broken. CEO Lacan stepped down in September 2018. No public record of fund recovery or arrests.
One of the largest publicly named CEO-fraud/BEC losses, and a rare case where the full mechanics were exposed by court proceedings rather than a company disclosure. It shows BEC can target an entire subsidiary's leadership (not just a lone clerk), that even experienced finance executives who sense something is "strange" will proceed absent hard controls, and that the human cost extends to careers and litigation. It also underscores that the presence of red flags is meaningless without training and enforced verification procedures, since the court itself noted Pathé had never trained the CFO to detect fraud.
Enforce out-of-band verification (a known-good phone number or in-person confirmation) for any high-value or unusual wire, especially "confidential" or urgent ones, and never verify via the same email thread. Treat demands for secrecy, refusal of phone calls, and instructions to bypass the board as red flags, not proof of importance. Require dual authorization and independent finance sign-off for large or cross-entity transfers, with tighter scrutiny as amounts escalate. Flag payments to newly introduced third-party or foreign accounts and confirm beneficiaries through trusted channels. Distinguish "personal" email addresses from verified corporate ones. Provide recurring BEC/CEO-fraud awareness training so staff can name the pattern and are empowered to pause payments.
A phishing email tricked Unatrac's CFO into surrendering his Office365 credentials on a fake Microsoft login page; the attacker then…
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
A European subsidiary of Toyota parts maker Toyota Boshoku wired roughly 4 billion yen (~$37M) to criminals in August 2019…
Social Engineering Examples