The email informed McMurty that Scoular was set to acquire a Chinese company.Įlsea instructed McMurty to contact a lawyer at accounting firm KPMG. In June 2014, Keith McMurtry, an employee at Scouler Co, a company in Omaha, Nebraska, received an email supposedly from his boss, CEO Chuck Elsea. This example demonstrates how fraudsters can play on a target’s trust and exploit interpersonal relationships. The money transfers also went directly into overseas accounts, meaning that local law enforcement couldn’t aid in recovering them.

Using phishing emails to secure the login credentials of business executives (including the CFO of British company Unatrac Holding), these initial phishing scams then acted as a platform for BEC.Īs is often the case, BEC was just one part of a tapestry of fraud and cybercrime, with Okeke also creating fraudulent webpages to further manipulate his victims. In February 2021, celebrated entrepreneur Obinwanne Okeke was sentenced to 10 years in prison for his involvement in a BEC scheme that resulted in at least $11 million in losses to his victims. With BEC on the rise, and this attack being the third that Toyota had experienced that year so far, critics say that Toyota should have been on the lookout for the scam.Īs Toyota learnt the hard way, BEC attacks often exist in multiples – with one attack opening the door to many more as money, IP, data or identities are stolen.Ĥ. The huge size of the company meant that though $37 million may appear alarming to you or I, hackers were able to implore an employee to transfer the sum out of the European subsidiary before being detected. Kicking things off with a name you may recognize – in 2019 Japan’s Toyota Boshoku Corporation was hit with a $37 million BEC attack. VEC attacks previously relied on domain impersonation and email spoofing techniques, but these days, scammers are increasingly turning to the more sophisticated account takeover method. We still don’t know precisely how the cybercriminals pulled off this massive scam. The scammers impersonated employees at a third-party company and targeted Ubiquiti’s finance department.

This attack was an example of a type of BEC, sometimes called Vendor Email Compromise (VEC ). Securities and Exchange Commission revealing it was the victim of a $46.7 million “business fraud.” In August 2015, IT company Ubiquiti filed a report to the U.S. If two of the world’s biggest tech companies lost millions to BEC over a two-year period - it could happen to any business. The Rimasauskas scam stands as a lesson to all organizations. The group then presented Facebook and Google with convincing-looking invoices, which they duly paid to bank accounts controlled by Rimasauskas.Īs well as fake invoices, the scammers prepared counterfeit lawyers’ letters and contracts to ensure their banks accepted the transfers. Rimasauskas and associates set up a fake company named “Quanta Computer” - the same name as a real hardware supplier. So how did some of the world’s most tech-savvy employees fall for this elaborate hoax? The scam took place between 20 - and the man at the center of this BEC attack, Evaldas Rimasauskas, was sentenced to five years in prison in 2019. First, let’s look at the biggest known BEC scam of all time: a VEC attack against tech giants Facebook and Google that resulted in around $121 million in collective losses.

Million facebook google invoices scam