Documented social engineering incidents targeting the retail & e-commerce sector, sourced and fact-checked.
Scheme participants posed as veteran finance professionals inside private WhatsApp investment groups to lure at least 18 U.S. retail investors into a fake.
ConfirmedCensys researchers used passive DNS to unravel a live USPS/UPS "package awaiting action" smishing operation.
ConfirmedA mass-phishing malware infection at Target's small HVAC contractor harvested vendor-portal credentials that attackers reused to pivot.
ConfirmedA federal grand jury in Columbia, South Carolina indicted 12 people on 12 counts (conspiracy, wire fraud, bank fraud.
ConfirmedTwo Scottish small businesses lost £31,000 and over £5,000 after callers impersonating bank fraud-team staff talked owners into wiring money.
ConfirmedTV investigative reporters filmed Rite Aid pharmacy dumpsters nationwide overflowing with readable prescription labels.
ConfirmedP&G-hired competitive-intelligence contractors retrieved roughly 80 unshredded confidential Unilever hair-care documents from the trash before P&G.
ConfirmedNTS IT Care used fake Microsoft/Apple security pop-ups to scare consumers, mostly older Americans.
ConfirmedA Mattel finance executive wired $3M to China on a forged email from her brand-new CEO.
ConfirmedA retired New Jersey man lost $390,000 in two days after a fake Norton/PayPal refund call escalated into a bogus PNC "mistaken deposit" story that had him.
ConfirmedTejay Fletcher founded and ran iSpoof, a Bitcoin-subscription caller-ID spoofing and OTP-interception platform that let fraudsters impersonate bank.
ConfirmedFIN7 (Carbanak) mailed USPS packages disguised as Best Buy gift-card rewards containing BadUSB hardware implants to HR, IT.
ConfirmedDOJ unsealed indictments and won guilty pleas, prison terms, and multimillion-dollar restitution against FIN7 (Carbanak Group) members Fedir Hladyr.
ConfirmedThe FBI, FTC, and USPIS each issued 2025 public warnings about "brushing 2.0" -- unsolicited packages containing QR codes that, when scanned.
ConfirmedA caller posing as two different Clorox employees talked Cognizant's outsourced IT help desk into resetting their passwords and MFA (including the SMS-MFA.
ConfirmedFraudsters spoofed Barclays' real phone number and hold music, posed as the bank's fraud team in a two-caller vishing script.
ConfirmedA single SMS-phishing campaign lured employees to fake Okta login pages, harvested ~9,931 credentials and 5,441 MFA codes across 136 organizations.
Social Engineering Examples