Scoular Company $17.2M grain-trader wire fraud (2014)

What happened

In June 2014, Scoular's corporate controller received emails appearing to come from the chief executive instructing him to wire funds for a confidential acquisition of a Chinese company, purportedly conducted under SEC supervision. The emails told him to coordinate with a named senior figure at KPMG, the firm that was in fact conducting the company's annual audit, who would provide wiring instructions. He was instructed to wire $780,000 on 26 June, $7 million on 27 June and $9.4 million on 30 June, a total of $17.2 million, to an account in the name of "Dadi Co" at Shanghai Pudong Development Bank. Every element was fraudulent: the CEO emails came from an account the criminals had created in his name, not the chief executive's real address, and the "KPMG" contact used a look-alike domain (kpmg-office.com) with a fake phone number answered by an accomplice. According to the FBI affidavit, the individual whose identity was used told investigators he was not familiar with the company and had not spoken with anyone there. The incident is documented in an FBI special agent's affidavit filed in U.S. District Court in Omaha (District of Nebraska). The Omaha World-Herald broke the story on 4 February 2015; Reuters, The Guardian, CSO Online and Infosecurity Magazine followed within the week, and the Financial Times and the ABA Journal revisited the case in more detail in February 2016. The company confirmed the fraud on the record to CSO Online.

How it worked

The attackers built a layered pretext rather than a single spoofed email. They impersonated the CEO to invoke authority and imposed secrecy ("This is very sensitive, so please only communicate with me through this email, in order for us not to infringe SEC regulations"), which discouraged the controller from verifying through normal channels. They then added a trusted third party by impersonating a real senior figure at KPMG via a convincing look-alike domain and staffing a phone line so that a call to "verify" was answered by a confederate using the right name. What made the story land was the controller's own situation. He told the FBI he was not suspicious because Scoular had been discussing expanding in China and he was at the time working on the annual audit with the company's outside accounting firm. Whether the attackers knew any of that is undocumented, and Infosecurity Magazine said so at the time: "it's not clear whether the fraudsters knew this or just got lucky." The pretext was in fact reusable. The Financial Times found a near-identical email sent in May 2014 to the director of accounting at an aerospace and oil services company, carrying the same file-number formula, the same confidentiality sentence and the same KPMG-lawyer hook, with a different executive name and a different lawyer name dropped in. Flattery and reward ("I will not forget your professionalism... I will show you my appreciation") and urgency to complete tranches quickly reduced further scrutiny. Infrastructure was internationally distributed (email/phone traced to Germany, France, Israel and Moscow servers) to frustrate attribution.

The lure and the tell

Lure: a "strictly confidential" CEO email assigning the controller to a secret, SEC-supervised acquisition ("I have assigned you to manage file FT-809. This is a strictly confidential operation, which takes priority over other tasks. Have you already been contacted by [name withheld, a senior figure at the accounting firm]?") with instructions to wire funds and coordinate with that individual. Tells: the CEO email did not come from his real corporate address; the "KPMG" contact used a look-alike domain (kpmg-office.com) instead of kpmg.com; an insistence on communicating only through one channel and invoking "SEC regulations" to block out-of-band verification; and a large, unusual, secret cross-border wire that bypassed normal approval and could have been debunked by one independent phone call to the CEO or KPMG's main line.

Outcome

Scoular discovered the fraud in June 2014 and reported it to authorities. In late January 2015 the FBI applied to the U.S. District Court in Omaha for seizure warrants against the Shanghai-based recipient, Dadi Co Ltd, and it subsequently obtained a court order to seize the funds held at Shanghai Pudong Development Bank. It was then told that the account had been closed and the funds transferred, so the $17.2M was not recovered. The controller who sent the wires was no longer with the company. Scoular's chief executive said the company's business had not and would not be affected by the loss.

Why it matters

A textbook, high-dollar business email compromise (CEO fraud) that shows social engineering, not malware, drove the loss. It is widely cited as an early landmark BEC case: the attackers combined executive impersonation, enforced secrecy, a trusted-brand third party (the firm actually conducting the company's audit) via a look-alike domain, and even a live phone confederate. The story was believable because it happened to match circumstances the controller knew to be real, though no source establishes that the attackers knew those circumstances. It demonstrates why out-of-band verification of payment changes and large wires, using independently obtained contact details, must be mandatory regardless of apparent seniority or confidentiality demands.

Defenses

Require out-of-band verification (a call-back to a known, independently sourced number) for any large or unusual wire, and never accept a phone number supplied within the request itself. Treat demands for secrecy or "do not discuss through other channels" as a red flag, not a reason to skip controls. Enforce dual authorization and separation of duties on high-value transfers. Verify sender domains carefully (kpmg.com vs kpmg-office.com). Monitor look-alike domain registrations across the company's own brand and the names of its auditors, law firms and banks; filter or quarantine mail from newly registered domains; apply an external-sender banner to every message from outside the organization; and flag any external message whose display name matches an executive. Domain authentication is not the control here. SPF, DKIM and DMARC verify that a message really came from the domain it claims to come from, and both fraudulent accounts in this case were registered by the criminals themselves, so each message passed cleanly on its own domain. Publishing DMARC on the victim's domain would have stopped neither email. Independently confirm that any "confidential deal" is real with the named executive directly. Train finance staff specifically on CEO-fraud/BEC pretexts and rehearse the "verify before you wire" reflex.