Documented cases attributed to unknown threat actors, sourced and fact-checked.
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from a Wells Fargo customer, and the bank's wire-verification representative then said aloud that the amount was unusual, that the account had been flagged and that a second review was required, and released the $100,000 wire anyway, per a Los Angeles lawsuit built partly on the bank's own recorded verification call.
DocumentedFraudsters built a fake WhatsApp profile of WPP CEO Mark Read and staged a Microsoft Teams call, deploying an AI voice clone of a second senior executive alongside existing YouTube footage of that executive, to press a WPP agency leader to help set up a "new business" as a route to money and personal details; no payment was ever requested, and WPP credited the targeted executive's vigilance with preventing the incident.
DocumentedA Ukrainian-language "shared document" phishing wave used a fake reCAPTCHA "verify you are human" ClickFix page to trick victims into pasting and running PowerShell themselves, deploying a rarely-seen infostealer Proofpoint dubbed suspected "Lucky Volunteer" in activity assessed to overlap with the Russia-linked espionage actor UAC-0050.
DocumentedFraudsters impersonating Ubiquiti's CEO and a partner at an outside law firm tricked the company's principal financial officer and controller into wiring $46.7M out of the Hong Kong subsidiary's bank account in 14 transfers over two weeks.
DocumentedThe CEO of a UK energy firm was tricked into wiring €220,000 (~$243,000) to a Hungarian account in March 2019 after a phone call using AI-cloned audio of his German parent company's own CEO's voice, marking the first widely reported criminal use of AI voice-cloning technology, disclosed by insurer Euler Hermes.
Reported/allegedVidoc Security Lab, a Polish-founded, US-headquartered cybersecurity startup, says two job candidates using fabricated identities reached interviews for a Poland-based remote engineering role. The second was recorded on camera behind a real-time face filter; the first was suspected of the same, but the company recorded nothing and has said it had no evidence. Every published account of both incidents traces back to the company's two cofounders.
DocumentedAn unidentified impersonator used a voice that government officials believed was AI-generated and a hacked personal-contacts list to pose as the White House chief of staff, texting and calling senators, governors and business leaders with requests including a pardon list and a cash transfer, triggering an FBI investigation in May 2025.
DocumentedA malware-laced phishing email at Target's small HVAC contractor harvested credentials for Target's vendor-facing systems, which attackers reused to reach Target's network and plant POS malware, exposing ~40M payment cards and ~70M customer records.
DocumentedA European subsidiary of Toyota parts maker Toyota Boshoku transferred up to about 4 billion yen (~$37M) to criminals in August 2019 after acting on fraudulent payment instructions; the audited accounts later booked a 3,393 million yen loss.
DocumentedA caller posing as a Standard Bank representative persuaded the 18-year-old account holder to move her R438,900 education trust fund to a "safe" Capitec account, with three transfers completed within 20 minutes; Standard Bank said she could have been a victim of vishing and that its findings did not support a systems compromise or an immediately preceding internal information breach, and the July 20, 2026 report said the case had been escalated to the National Financial Ombud and North West police.
DocumentedA Snap Inc. payroll employee emailed the W-2 and payroll data of roughly 700 current and former employees to an attacker who spoofed the identity of Snap Inc.'s chief executive, part of a nationwide spring-2016 wave of spoofed-executive W-2 phishing that prompted an IRS public alert.
DocumentedSCE reported $131,464 collected by scammers across its 2025 customer fraud complaints. Its warnings describe immediate-disconnection and meter-removal threats as examples of utility impersonation, not as the proven mechanism behind every reported loss.
DocumentedImpostors posing as Scoular's CEO and a senior figure at its audit firm convinced the controller a secret China acquisition was underway, and he wired $17.2M in three tranches to a Shanghai account.
DocumentedA phishing attack resulted in disclosure of 2015 W-2 data for several thousand US employees, exposing SSNs and earnings to an unauthorized party.
DocumentedAttackers hijacked a staff email account and used fake solar-panel invoices to trick the US charity into wiring $997,400 to Japan; insurance covered all but roughly $112,000.
DocumentedA small Columbus, Ohio public materials manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an "imposter scam executed in conjunction with bank fraud," recovering only $336,299 by the following quarter despite same-day bank, FBI, and insurer engagement.
DocumentedA Pune CFO wired Rs 56 lakh after a Microsoft Teams message impersonating her Italian CEO's name and photo demanded an urgent transfer, then caught the fraud only when a follow-up Rs 1.5 crore ask prompted her to call the real CEO.
DocumentedA compromised email address was used to redirect a $30,750 solar-panel-installation payment from a Wheeling, WV economic development nonprofit into Pierce's account. Investigators also linked Pierce to additional fraudulent activity involving approximately $220,000 in actual or intended loss, and he later admitted to wire fraud.
DocumentedA smishing text and a follow-up call from a fake IT colleague talked a Retool employee out of two one-time codes; Google Authenticator cloud sync then collapsed the company's MFA and attackers took over 27 crypto customer accounts. Retool says the caller used a deepfake of a real employee's voice, a claim Ars Technica called completely unverified, and the roughly $15M crypto loss was disclosed by a downstream customer, Fortress Trust, not by Retool.
DocumentedA non-executive Orion S.A. employee was manipulated by a criminal scheme into sending multiple outbound wires totaling roughly $60M to attacker-controlled accounts, with no system or data breach involved.
DocumentedIn the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a barcode or QR code arrives by text or email, with orders to pay it at a store checkout. By the middle of 2026, PG&E customers had reported more than $211,000 in losses, and the company suspects the barcode trick is part of why.
DocumentedA Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a hacker was draining her account, so she wired her own money to the scammers. His number matched the one on the back of her card. ABC7 Chicago reported the case in January 2025 under the FBI's "Phantom Hacker" label. The $20,000 is her own figure, and none of it has come back.
DocumentedImpersonators posing as two School District of Philadelphia vendors switched payments from paper check to ACH and diverted nearly $700,000 into fraud accounts; the discrepancy was identified during audit work.
DocumentedScammers hijacked a real invoice thread between an Arkansas school district, its contractor, and its architect, then used a lookalike "easthardings.com" domain to redirect a $3.2M construction payment to accounts they controlled.
DocumentedA fraudster impersonating the company's chief executive tricked a Pivotal employee into emailing back affected employees' W-2 tax data.
DocumentedA forged "change your remittance bank account" email tricked a Puerto Rico government corporation into wiring $2.6M to a fraudster-controlled account in January 2020.
DocumentedRoughly 200 counterfeit QR-code stickers were recovered from downtown Orlando parking meters, where unknown suspects had placed them over the genuine ParkMobile decals so that a scan led to a fraudulent site soliciting personal and financial information. No victim and no loss was ever confirmed.
DocumentedA Bengaluru retiree lost Rs 6.88 lakh after an AI-generated deepfake Facebook video falsely showed the finance minister endorsing a fake SBI/Finance-Ministry-linked investment scheme, with WhatsApp callers from a UK number then upselling him into repeated transfers.
DocumentedA scammer spoofed a New Zealand bank's number and obtained authentication codes by claiming they would suspend banking and cancel payments. A NZD 30,000 unauthorized credit-card transaction followed; a later safe-account request raised the customer's suspicions. The Ombudsman recommended reimbursement, without documenting that it was paid.
Research/advisoryA Russian-speaking threat actor used disposable, one-conversation ChatGPT accounts to iteratively build and debug a Go-based Windows malware family and its C2 server, distributing it through a public repository disguised as the "Crosshair-X" gaming overlay tool, until OpenAI's abuse-detection system caught and dismantled the operation.
DocumentedAttackers hijacked the New Haven school COO's email, quietly monitored a real $5.9M bus-contract payment thread, then posed as the vendor and were told by city and school staff to change the vendor's bank details themselves in the city's online vendor portal, diverting about $6M in city funds.
DocumentedA spoofed-email scheme impersonating MacEwan University's trusted general contractor, Clark Builders, tricked staff into redirecting $11.8 million CAD in construction payments to fraudulent bank accounts in Montreal and Hong Kong, one of the largest publicly documented BEC transfers at a North American university.
DocumentedA spoofed email impersonating a company executive tricked a Main Line Health employee into emailing the W-2 and personal data of all ~11,000 staff to criminals.
DocumentedA Mattel finance executive wired $3M to China on a forged email from her brand-new CEO, and the company clawed it back within days thanks to a Chinese bank holiday and an FBI letter.
DocumentedSpoofed emails impersonating Medidata's president, backed by a fake "lawyer" caller, tricked finance staff into wiring $4.8M to an overseas account for a bogus acquisition.
DocumentedFraudsters impersonating Leoni AG's senior executives tricked the German cable manufacturer's Romanian subsidiary finance team into wiring roughly EUR 40 million (about US$44.6 million) to attacker-controlled accounts in August 2016.
DocumentedAT&T Cybersecurity's MTDR SOC documented a client quishing case in which a PDF impersonating a Microsoft MFA-setup notice, hiding a malicious QR code, drove several employees to a fake Microsoft login page that harvested their credentials; the vendor reported the incident fully remediated with no confirmed data loss.
DocumentedAn attacker impersonated LastPass's CEO with an AI voice clone over WhatsApp, but the targeted employee spotted the red flags, ignored it, and reported it to security; LastPass said the attempt caused no impact.
Reported/allegedJLR's 2025 cyber incident halted production for roughly five weeks. The Cyber Monitoring Centre modeled £1.9bn of UK-wide economic impact; subsequent reporting challenged the original vishing account. JLR's then-CISO denied social engineering but did not confirm who was responsible.
DocumentedHornetsecurity documented a QR-phishing (quishing) email sent to a single employee at a US-based MSP that spoofed an MFA-reactivation notice with a QR code leading, via a .ru-hosted fake "security scan" page behind Cloudflare, to a freshly registered Microsoft 365 credential-harvesting login page; Hornetsecurity's write-up documents this technical chain but does not confirm the employee scanned the code or that any downstream step actually occurred.
DocumentedA fraudulent email impersonating The Depository Trust Company (DTC) supplied fake wire instructions for JE Cleantech Holdings' declared cash dividend, diverting USD 794,934.04 away from DTC and delaying payment to shareholders.
Research/advisoryGoogle's Threat Intelligence Group disclosed PROMPTFLUX, an experimental VBScript dropper that queries the Gemini API mid-execution for antivirus-evasion code and logs the model's replies to a file in %TEMP%, with the function that would apply them present but commented out; GTIG said this was the first time it had identified malware using an LLM during execution, and assessed that the samples do not demonstrate an ability to compromise a victim network or device.
DocumentedA scammer posing as GCI's CFO emailed payroll and, after the employee's initial pushback, persuaded them to hand over 2015 W-2s for every GCI, Denali Media, UUI and Unicom worker.
Research/advisoryAn FTC consumer alert (Dec 6, 2023) warning that scammers cover parking-meter QR codes with their own and send QR codes by email and text, routing people to spoofed login pages or malware.
Research/advisoryThe FBI's IC3 issued a December 2024 public advisory detailing how criminals use AI-generated text, images, voice cloning, and deepfake video to make fraud schemes, including loved-one crisis scams and bank-account impersonation, more scalable and believable.
Research/advisoryThe FBI, FTC, and USPIS each issued 2025 public warnings about "brushing 2.0" -- unsolicited packages containing QR codes that, when scanned, send recipients to phishing sites or malware instead of the promised gift-sender reveal or return instructions.
DocumentedFraudsters impersonating FACC's CEO by email convinced finance staff to wire roughly EUR 50M for a fake acquisition project; EUR 41.9M was lost and both the CEO and CFO were later fired.
DocumentedA victim searching for the AnyDesk remote-access tool hit a typosquatted site with a fake Cloudflare Turnstile that, instead of the usual ClickFix paste-and-run trick, abused the Windows search-ms protocol to pull a disguised LNK/PDF from an attacker SMB share, ultimately installing an MSI that fingerprinted the host and dropped the MetaStealer infostealer.
DocumentedA convincing fake ChatGPT download site, openew[.]app -- reached in part via an AI-generated fake outage page rendered on a real chatgpt.com/s/ URL -- used malvertising and SEO poisoning to push Windows visitors to a credential-stealing loader and Mac visitors to Odyssey Stealer (an AMOS/Atomic Stealer fork) that also swapped in trojanized Ledger and Trezor wallet apps.
Research/advisoryThe FBI's 2025 Internet Crime Report introduced IC3's first-ever dedicated AI-fraud tracking section in its nearly 25-year history, logging 22,364 complaints and $893,346,472 in losses from scams using voice clones, deepfake video, fake AI-generated social profiles, and forged identification documents.
DocumentedCVS pharmacies nationwide tossed pill bottles, prescriptions, and employee SSNs into unsecured public dumpsters; media exposure across a dozen-plus cities led to a $2.25M HHS settlement and a separate FTC consent order in 2009.
DocumentedCriminals impersonated a trusted vendor over email and redirected two building-fund payments totaling $4.92M from a North Dakota school district; the FBI and U.S. Attorney's Office later seized about $4.86M.
DocumentedA Brighton-area kitchen fitter lost roughly £76,000, including four loans he was pressured into taking out, after a Facebook ad using deepfaked video of a consumer-finance advocate and a technology entrepreneur lured him into a fake bitcoin investment run through a Revolut account.
DocumentedScammers impersonating a school construction contractor submitted a bank-account-change request with seemingly valid documentation, and Cabarrus County, NC wired $2.5M to the fraud account, resulting in a reported $1.73M net loss.
DocumentedAn infected USB flash drive introduced onto a U.S. military laptop in 2008 let the agent.btz worm cross onto classified SIPRNet and JWICS systems, triggering a 14 month Pentagon cleanup and a worldwide ban on thumb drives, and helping spur the creation of U.S. Cyber Command.
DocumentedA finance employee in Arup's Hong Kong office made 15 transfers totaling HK$200M (about US$25.6M) after joining a video conference in which, Hong Kong Police said, every participant except the employee was a deepfake built from publicly available footage.
DocumentedArgan's Fiscal 2024 cybersecurity disclosure described fraudulently induced outbound wire transfers in March 2023 and reported $2.7 million of loss, net of recovered funds and including related professional fees.
DocumentedFraudsters spoofed Barclays' real phone number and hold music, posed as the bank's fraud team in a two-caller vishing script, and talked a 70-something UK jeweller into installing AnyDesk on his business PC, draining GBP 48,451.78 from two accounts. Professional Jeweller reported that the victim's law firm later recovered GBP 25,650 from Barclays.
Reported/allegedBinance's then chief communications officer claimed scammers built an AI deepfake "hologram" of him from his TV interview footage and used it in live Zoom calls to convince crypto project teams they'd had real Binance token-listing meetings. Contemporaneous August 2022 reporting said the claim lacked independent technical verification and a publicly released video or audio sample.
DocumentedAttackers stood up a real Azure subscription and Azure Monitor alert rule to make Microsoft's own mail servers send a fully SPF/DKIM/DMARC-authenticated fake $459.90 Windows Defender billing notice with fraud callback numbers, which a human SOC reviewer cleared as a false positive.
DocumentedA fraudster posing as AFGlobal's CEO, backed by a fake KPMG "attorney," pressured the accounting director into wiring $480,000 to a Chinese bank; a follow-up $18M ask blew the scheme.
DocumentedFraudsters impersonating an Ascend Laboratories executive convinced Alkem Laboratories to wire USD 6,161,336 (about Rs 51.30 crore) to a fraudulent US bank account under a bogus tax-refund pretext; Rs 222.7 million remains unrecovered, and a second, separate business email compromise hit Alkem's Enzene Biosciences US subsidiary roughly 18 months later.
DocumentedThe SEC's 2018 Section 21(a) report detailed how fake-executive and fake-vendor BEC emails caused nearly $100 million in combined losses at nine public companies and examined how internal accounting controls should account for cyber-related fraud.
DocumentedHours before Maharashtra's 2024 assembly election polling, BJP-amplified audio clips purporting to catch two opposition leaders discussing a bitcoin-funded election bribery scheme were independently forensically confirmed as substantially AI-generated voice clones.
Social Engineering Examples