Documented social engineering incidents targeting the transportation & logistics sector, sourced and fact-checked.
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push prompts, then posed as tech support to get one approved, opening the door to Uber's internal network.
DocumentedFake QR stickers on UK council parking machines sent drivers to cloned payment sites. 123 of 373 councils were hit in a year. How it works, who's behind it.
DocumentedCensys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed. How it worked and how to tell.
DocumentedOrlando police pulled about 200 fake QR stickers off downtown parking meters in June 2025. How to spot them: white sticker, peels off. No losses confirmed.
DocumentedA 2025 campaign faked Portugal's tax authority and asked victims to paste a command to 'enable file preview', starting a chain to the Lampion banking trojan.
Research/advisoryThree separate congressional watchdog engagements, not one campaign. In 2000, GAO agents carrying counterfeit badges declared themselves armed officers and were waved around screening at all 21 sites they tried. In 2002, they talked a pass-issuing clerk out of a genuine building pass, forged copies for the team, and breached four of the five Atlanta buildings tested. In 2009 a differently designed test used no deception at all. No public record substantiates a parallel breach of the U.S. Capitol or the GAO-13-370T report cited in some retellings.
DocumentedDOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records describe the fake Combi Security recruitment front; separately reported FBI attribution links FIN7 to later malicious-USB mailings.
DocumentedFraudsters impersonating FACC's CEO by email convinced finance staff to wire roughly EUR 50M for a fake acquisition project; EUR 41.9M was lost and both the CEO and CFO were later fired.
Research/advisoryIn 2025 the FBI, FTC and USPIS warned of unordered packages with QR codes that lead to phishing sites or malware. How the brushing 2.0 scam works.
DocumentedAir Canada admitted in a sworn Ontario Superior Court affidavit that it hired private investigators who twice took trash from outside the home of WestJet's co-founder and vice-president of strategic planning (a collection his own affidavit says involved the investigators walking onto his driveway, a claim IPSA disputed) and had shredded documents digitally reconstructed by a Houston forensic firm, as part of its corporate-espionage suit against WestJet, a fight that ended in a CAD 15.5 million WestJet settlement and public apology.
Social Engineering Examples