Unatrac Holding (Caterpillar Export Office) $11M CFO Business Email Compromise

What happened

In April 2018, an attacker phished the CFO of Unatrac Holding Limited (a UK export sales office for Caterpillar heavy equipment) with a fake Microsoft Office365 login page, stealing his real credentials. Using that access, the intruder logged into the CFO's live email account over 460 times across two weeks, learned the company's invoice formats and branding, and then sent roughly 15 fraudulent wire-transfer requests with fake invoices from the CFO's genuine mailbox to Unatrac finance staff between April 11 and April 19, 2018. Believing the requests were legitimate, staff wired nearly $11 million to accounts overseas; almost none of it was recovered. The FBI later tied the intrusion to Nigerian national Obinwanne Okeke, who was charged, pleaded guilty, and was sentenced to 10 years in federal prison as part of a broader multi-victim BEC/computer-fraud conspiracy.

One point the coverage got wrong repeatedly: Caterpillar Inc. was not the victim. Unatrac Holding Limited is an independently owned Caterpillar dealer in the Mansour family's Mantrac Group, and its own published statement says it "has been appointed as a dealer by Caterpillar SARL, a subsidiary of Caterpillar Inc." Both DOJ and the FBI affidavit use the shorthand "the export sales office for Caterpillar heavy industrial and farm equipment," which several outlets turned into the claim that Caterpillar Inc. lost $11 million. It lost nothing here.

How it worked

Around April 1, 2018, Unatrac's CFO received a phishing email containing a link to a spoofed Microsoft Office365 login page. He entered his credentials on the fake page, and the attacker captured them. Using the stolen credentials, the intruder logged into the CFO's actual Office365 mailbox at least 464 times between April 6 and April 20, 2018, mostly from IP addresses geolocated to Nigeria. With full access to the CFO's live mailbox, OneDrive files, and email history, the attacker studied Unatrac's real invoice templates and company logos, then impersonated the CFO by sending wire-transfer instructions directly from his actual email account (not a lookalike domain) to Unatrac's internal finance staff. Fake invoices, some using genuine Unatrac branding, were attached to make the requests appear routine. In at least one instance (April 19, 2018), the attacker forwarded an external email from a Gmail address with a fraudulent invoice into the CFO's outgoing traffic within two minutes of it arriving, evidently to make the payment request appear corroborated. The intruder also created or modified email filter rules that intercepted messages to and from the finance team, marked them as read, and moved them to a folder outside the inbox, hiding the finance team's replies from the real CFO and delaying discovery. These were filter rules, not auto-forwarding rules; nothing was routed to an external address. Believing the requests came from their own CFO, finance staff processed roughly 15 fraudulent wire payments between April 11 and April 19, 2018, sending funds to accounts including one held by "Pak Fei Trade Limited."

The lure and the tell

The lure was a phishing email luring the CFO to a convincing fake Microsoft Office365 login page to harvest his credentials. Once inside, the attacker's fraudulent wire requests came from the CFO's genuine, unspoofed email address, complete with real company logos and preformatted invoice templates, and were reinforced by a forwarded third-party email inserted into the thread within minutes to simulate independent confirmation. The signals sitting in the record, though no investigator assembled them into a published list of tells: a new, unfamiliar payee (Pak Fei Trade Limited) receiving three large wires in quick succession; at least 464 mailbox logins from Nigerian IP addresses against a UK executive's account in a two-week span; and seven filter-rule changes on the CFO's account that quietly moved the finance team's replies out of his inbox. No cited source records how fast the finance team acted on any single instruction. The only documented two-minute interval belongs to the intruder, not to the payments: the speed at which he forwarded an inbound external email onward with a fake invoice attached.

Outcome

Nearly $11 million was wired out of Unatrac to overseas accounts (including one belonging to "Pak Fei Trade Limited") before the fraud was discovered; the FBI affidavit states very little of the money was recovered. The FBI traced the intrusion, via linked Google/email account records, to Nigerian national Obinwanne Okeke (aka "Invictus Obi"), who was arrested in August 2019 and charged in the Eastern District of Virginia with conspiracy to commit computer fraud and conspiracy to commit wire fraud as part of a broader multi-year (circa 2015-2019) BEC and phishing conspiracy that victimized multiple companies. Okeke pleaded guilty to wire-fraud conspiracy on June 18, 2020, and was sentenced on February 16, 2021 by Senior U.S. District Judge Rebecca Beach Smith to 10 years in federal prison. DOJ's press release calls her "Chief" judge, but that title was already out of date: the Federal Judicial Center records that she served as chief judge from 2011 to 2018 and assumed senior status on August 1, 2019, and the Virginian-Pilot's sentencing report names her correctly as "Senior U.S. District Judge."

At sentencing the court also entered a restitution order for $10,679,166.54. Restitution ordered is not money returned. The FBI affidavit's finding that Unatrac recovered very little of the transferred funds was the position as of August 2019, and no public record establishes how much was ultimately collected against the order.

Why it matters

This case is one of the best court-documented anatomies of a "true" business email compromise: no lookalike domain or spoofed sender was needed because the attacker had the CFO's actual mailbox, making the fraudulent wire requests functionally indistinguishable from genuine ones to the recipients. It illustrates how a single successful credential-phishing click can cascade into millions in loss over just days, how attackers use mailbox reconnaissance (real logos, real invoice templates, real reply history) to make fraud look routine, and how mailbox rule manipulation is used to delay detection. It also shows the limits of after-the-fact recovery. The FBI's affidavit recorded that Unatrac got very little of the money back, and the paper judgment is not the same as cash returned. Prevention (MFA, callback verification, dual controls) is the part that actually works.

Defenses

Multi-factor authentication on all email/O365 accounts (would have blocked reuse of stolen credentials across 464+ logins); anomalous-login/impossible-travel alerting (logins originated mostly from Nigeria against a UK-based executive); monitoring/alerting on mailbox rule creation (the attacker created filter rules that moved the finance team's replies out of the CFO's inbox, a well-known BEC persistence technique); out-of-band verbal/callback verification for any changed or new wire/bank instructions, especially for high-value payments; dual-control/second-approval sign-off on wire transfers above a threshold; scrutiny of invoice-only "confirmation" of payee bank details rather than confirming via a known-good phone number or separate channel; staff training to treat urgent CFO-authorized payment requests via email, especially involving unfamiliar payees, as requiring independent verification; DMARC/anti-spoofing and safe-link/URL rewriting to catch credential-phishing pages impersonating Microsoft login; incident response plan for rapid bank recall requests (recovery was minimal here, and the FBI's IC3 tells BEC victims to contact the originating financial institution as soon as the fraud is recognized and to file an IC3 complaint, which is what starts the Recovery Asset Team's Financial Fraud Kill Chain).