Pathé €19.2M fake-CEO cinema-chain fraud (2018)

What happened

In March 2018, criminals impersonating the CEO of French parent Pathé emailed the two-person senior management of Pathé's Dutch subsidiary, its managing director and its finance director. Using an address the scammers presented as the group CEO's "personal" email, they claimed Pathé was carrying out a strictly confidential acquisition of a company in Dubai and needed urgent payments that would be reimbursed at month's end. Believing they were serving a deal authorized at the top of the group and deliberately kept from the supervisory board, the executives authorized six transfers to an account in the name of Towering Stars General Trading LLC in Dubai: €826,521 on March 9, €2,479,563 on March 13, a third tranche on March 16 and a fourth on March 20, then €5,826,770 on March 22 and €5,152,354 on March 27, totaling €19,244,304. The ruling states no amount for the third and fourth tranches, which together account for the remaining €4,959,096. The €5.0M that circulates in retellings as a payment was the size of a cash-pool withdrawal request, not a transfer to the fraudsters. When the Dutch unit ran short, it drew on the French group's central "cash pool." The fraud was exposed on March 28 when the real Paris headquarters queried the cash-pool withdrawals. Both executives were suspended, then dismissed in April. The details became public through an Amsterdam District Court ruling of October 31, 2018 in the finance director's wrongful-dismissal suit. The outside investigation Pathé commissioned reported that involvement by Pathé staff was not established, and that knowledge of the fraud before or during it was not established either, a narrower finding than a clean exoneration. This is a real, court-documented incident.

How it worked

A classic CEO-fraud/BEC pattern with a twist: instead of a fake CEO pressuring a subordinate CFO, the attackers impersonated the French parent's top leadership to instruct an entire overseas subsidiary's management. Opening emails asked innocuous questions (whether KPMG had been in touch) to build a plausible business context before introducing the money request. They leaned on authority (instructions ostensibly from the group's two most senior people), manufactured secrecy ("strictest confidentiality," reply only to the personal address, to keep a competitive edge and avoid disclosure), and legitimacy props (an invoice, a document bearing the CEO's and family shareholders' names/signatures, and claimed KPMG oversight). Requests to phone or involve the supervisory board were deflected as against "KPMG standards," keeping victims inside a channel the attackers controlled. Amounts started small and escalated once trust was established, and the promise of repayment reframed the outflows as temporary. By the finance director's account, the subsidiary had given him no fraud training and had no verification protocol, and requests that felt "strange" were executed anyway.

The lure and the tell

Lure: emails from the "personal" account of the parent-company CEO announcing a secret, time-sensitive Dubai acquisition, with instructions to pay tranches to a third-party account and keep it confidential. Tells: a superior demanding payments unrelated to the local entity's business; insistence on secrecy and email-only contact while refusing phone calls or board involvement; funds going to an unrelated third-party company abroad; escalating amounts; and the executives' own instincts. The managing director forwarded one message with the comment "Strange, nietwaar?" and the finance director replied "Wonderlijk proces. Nooit zo meegemaakt," rendered in English by Variety as "Curious process. Never experienced anything like that." Both instincts were overridden rather than acted on. One widely repeated tell does not survive the ruling: the address itself. The court found that the first visible address always ended in pathe.com, with a deviating address behind it, exactly as the executives' own genuine addresses did. What carried the warning was the instruction to move all contact to a claimed personal account, not the way the address looked.

Outcome

Pathé lost €19,244,304. Both Dutch executives were dismissed in April 2018. The finance director sued for wrongful dismissal; on October 31, 2018 the Amsterdam District Court ruled his summary dismissal was not justified and ordered Pathé to pay his salary of €13,503.09 gross a month from May 1 to December 1, 2018, but still dissolved the employment contract for culpable conduct, finding trust had irreparably broken. That ruling was at first instance. The managing director brought her own claim for compensation and reputational damage, heard on November 29, 2018. The group CEO stepped down in September 2018; Variety reported the conditions of his exit were not disclosed and that he remained on the board. Het Parool reported on November 10, 2018 that the money had not been traced.

Why it matters

One of the largest publicly named CEO-fraud/BEC losses, and a rare case where the full mechanics were exposed by court proceedings rather than a company disclosure. It shows BEC can target an entire subsidiary's leadership (not just a lone clerk), that even experienced finance executives who sense something is "strange" will proceed absent hard controls, and that the human cost extends to careers and litigation. It also underscores that red flags mean nothing without training and enforced verification. The finance director's own case was that Pathé had never trained or instructed him to spot fraud; the ruling records that as his argument and does not adopt it.

Defenses

Enforce out-of-band verification (a known-good phone number or in-person confirmation) for any high-value or unusual wire, especially "confidential" or urgent ones, and never verify via the same email thread. Treat demands for secrecy, refusal of phone calls, and instructions to bypass the board as red flags, not proof of importance. Require dual authorization and independent finance sign-off for large or cross-entity transfers, with tighter scrutiny as amounts escalate. Flag payments to newly introduced third-party or foreign accounts and confirm beneficiaries through trusted channels. Distinguish "personal" email addresses from verified corporate ones. Provide recurring BEC/CEO-fraud awareness training so staff can name the pattern and are empowered to pause payments.