A small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an "imposter scam executed in conjunction with bank fraud," recovering only $336,299 by the following quarter despite same-day bank, FBI, and insurer engagement.
Social Engineering Examples·7 sources
On February 10, 2026, SCI Engineered Materials, Inc. (OTCQB: SCIA), a small Columbus, Ohio-based manufacturer of physical-vapor-deposition thin-film materials, filed a Form 8-K (and a same-day 8-K/A correcting only an exhibit title) disclosing under Item 8.01 that it "was subjected to an imposter scam of $898,325 executed in conjunction with bank fraud." Per the filing, management contacted the company's financial institution and filed a report with the FBI's Internet Crime Complaint Center (IC3) immediately upon recognizing the event, and began working with its insurance carrier to pursue recovery. SCI stated it found no evidence of additional fraudulent activity and did not believe the incident led to unauthorized access to company data or systems, though an investigation into the incident's impact on internal controls remained ongoing. The company's subsequent Form 10-Q for Q1 2026 disclosed that $336,299 of the $898,325 had been recovered as of April 30, 2026, leaving a net fraud expense of $562,026 recognized in that quarter's results, a sum large enough to materially distort the quarter's operating-expense comparison versus the prior year.
SCI's February 10, 2026 disclosure describes an "imposter scam of $898,325 executed in conjunction with bank fraud." That notice does not identify the impersonated party, communication channel, lure, payment rail, authorizing employee or destination account. It supports the reported impersonation fraud and financial loss, but it does not establish a classic email-based BEC sequence.
The February 10 notice does not reproduce the fraudulent communication or explain how the company recognized it. A specific lure or tell cannot be reconstructed from that notice. Urgency, secrecy, lookalike domains and vendor-bank-detail changes should not be treated as facts of this incident.
As of June 30, 2026, SCI had recovered $336,299 of the $898,325 and retained the $562,026 fraud expense recorded in the first quarter. On July 12, 2026, the company was informed that a $250,000 Smart Cyber insurance claim was approved; SCI said the proceeds, when realized, would reduce the fraud expense to $312,026. SCI's February disclosure said management immediately contacted its bank, filed an FBI IC3 report, and worked with its insurer. It also said no additional fraudulent activity or unauthorized access had been found, business operations were unaffected, and the internal-controls investigation was then ongoing.
The February 10 notice and the second-quarter results excerpt separate gross fraud loss, recovered funds and an approved insurance claim. They establish the financial impact and response without specifying the original impersonation mechanism in those two passages. The case illustrates why an incident label alone is insufficient to reconstruct an attack sequence, and why approved insurance proceeds must be distinguished from money received.
SCI disclosed immediate bank notification, an FBI IC3 report, insurer engagement and an internal-controls investigation in February 2026. Independent counterparty verification, payment approval and prompt bank reporting are relevant general safeguards. The February 10 notice does not establish which preventive controls were missing or whether any particular control would certainly have stopped this fraud.
Social Engineering Examples. “SCI Engineered Materials $898,325 Imposter Scam / Bank Fraud (2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/sci-engineered-materials-imposter-scam-2026
SCI reported an imposter scam executed in conjunction with bank fraud. Its February 10 notice does not describe reconnaissance.
the February 10 notice does not establish a reconnaissance method, so an incident-specific preventive control cannot be assigned to this stage.
the February 10 notice does not identify the impersonated party or the communication channel.
independently verify a claimed counterparty's identity before acting on financial instructions; the disclosure does not establish whether email controls would have addressed this incident.
the February 10 notice does not provide a message, call script or payment instruction.
give staff an independent route to check unusual financial requests. This is a general recommendation, not a disclosed SCI control failure.
the February 10 notice does not establish who approved the transaction or whether urgency or secrecy was used.
require independent authorization for unusual financial instructions; do not infer an urgency or secrecy pretext from the loss alone.
SCI disclosed an $898,325 fraud loss; the notice does not identify a wire or ACH payment rail.
verify new or changed beneficiary instructions through a known contact and apply independent payment approval. These are general controls, not proven missing steps in this incident.
management contacted its financial institution, filed an FBI IC3 report and worked with its insurer immediately upon recognizing the event. The notice does not describe subsequent movement through mule accounts.
notify the bank and law enforcement promptly. SCI disclosed bank notification and an FBI IC3 report in its February 10 notice. Preserving the transaction record is a general recommendation, not an action established by that notice. The notice does not establish why recovery was partial.
As of June 30, 2026, SCI had recovered $336,299 and recorded fraud expense of $562,026. A $250,000 insurance claim was approved on July 12, but SCI said the expense would fall to $312,026 only when the proceeds were realized.
Cyber-crime insurance riders that explicitly cover social-engineering-induced fraud and continued law-enforcement engagement are potential backstops. SCI engaged its insurer, and a $250,000 Smart Cyber insurance claim was approved on July 12, 2026, but the company said the proceeds had yet to be realized.
Browse by what this case has in common with others in the library.
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
Scammers hijacked a real invoice thread with a lookalike domain and got an Arkansas school district to wire $3.2M. $1.1M…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
A phishing email tricked Unatrac's CFO into surrendering his Office365 credentials on a fake Microsoft login page; the attacker then…
Target's 2013 breach began with malware emailed to a small HVAC contractor. 40M cards and 70M records exposed. What's known,…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above…
DOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records…
Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
A Pune CFO sent Rs 56 lakh after a Microsoft Teams message from a fake CEO profile. A second Rs…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
KnowBe4 hired a North Korean operative using a stolen US identity and an AI-enhanced photo in 2024. Malware started on…
A compromised email sent a Wheeling, WV nonprofit a fake solar panel invoice. It paid $30,750 to an Oklahoma man's…
A single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that quietly stole…
In the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a…
Advance Machine Company's West Coast sales manager repeatedly rifled Tennant Company's sealed, covered dumpster in California to steal sales leads.
Target's 2013 breach began with malware emailed to a small HVAC contractor. 40M cards and 70M records exposed. What's known,…
A forged "change your remittance bank account" email tricked a Puerto Rico government corporation into wiring $2.6M to a fraudster-controlled…
In 2025 the FBI, FTC and USPIS warned of unordered packages with QR codes that lead to phishing sites or…
Employees scanned a QR code in a fake Microsoft MFA-setup PDF and gave up passwords on a cloned login. How…
Criminals posing as a vendor redirected $4.92M in North Dakota school building-fund payments in 2026. The FBI seized $4.86M. How…
OpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool.…