The Wire Transfer Fraud
Marcus had been called in before breakfast. The CFO's office was tense — assistants hovering outside, the CFO himself pacing behind his desk. Marcus was a corporate security awareness trainer, and in twelve years he had never been called in like this.
"$185,000," the CFO said without preamble. "Wired out yesterday afternoon. Fraudulent account. Gone."
Marcus set down his bag and asked the first question he always asked. "What systems were compromised?"
"That's just it." The CFO stopped pacing. "None. IT forensics has been through everything. No malware. No breach. No unauthorized access to any system."
Marcus asked to speak with Daniel, the CFO's executive assistant. Daniel was visibly shaken. He explained: around 2:15 PM the previous day, he had received an email that appeared to come from the CEO. The CEO was traveling — attending a conference in Boston, which Daniel knew because he had booked the flights. The email said there was a critical acquisition in progress, that it needed to close before market end-of-day, that it was confidential and Daniel should not discuss it with anyone — not even the CFO — and that a wire transfer of $185,000 needed to be initiated immediately to a provided account number.
"He said he couldn't take calls because he was in back-to-back meetings," Daniel said. "He sounded exactly like himself. I've been working with him for six years."
Marcus nodded slowly. This was Business Email Compromise — one of the most financially damaging cybercrimes in the world. No systems had been hacked. No malware had been installed. The technical attack surface had never been touched. The human had been the target, the vector, and the exploit — all at once.
"The attacker," Marcus explained to the CFO, "never needed to touch your network. Your firewalls, your EDR, your SIEM — none of it was relevant. Daniel was the vulnerability, and he's not broken. He was carefully manipulated by someone who did their homework."
What Is Social Engineering?
That afternoon, Marcus gathered the security team and key staff for a briefing. He started at the beginning.
"Social engineering is manipulating people into performing actions or divulging information that compromises security. It works because humans have predictable psychological responses — we trust authority, we help people who seem to need help, we respond to urgency, we don't want to be rude or obstructive. Attackers exploit these responses rather than technical vulnerabilities."
He wrote six principles on the whiteboard — drawn from the influence research of Robert Cialdini, which social engineers had adopted as their practical playbook:
AUTHORITY: People comply with requests from those who appear to have power or expertise. We are trained from childhood to obey authority figures — executives, law enforcement, IT administrators, doctors. An attacker impersonating any of these gets a significant compliance advantage before they say a word.
URGENCY: Time pressure disables critical thinking. When we believe we must act immediately, we skip verification steps, bypass procedures, and comply without questioning. Urgency is probably the attacker's most reliable tool — it turns off the brain's security checking.
SCARCITY: Fear of losing something or missing out. "Your account will be suspended in 24 hours." "This is your last chance to verify your information." The threat of loss creates compliance.
SOCIAL PROOF: If everyone else is doing it, it must be acceptable. "All of your colleagues have already updated their credentials in the new system." This reduces the target's sense that they're doing something unusual.
FAMILIARITY / LIKING: We trust people we know or who seem like us. Attackers research their targets to build rapport — referencing mutual contacts, shared interests, recent events. An email from a "stranger" who mentions your actual manager by name feels like it's from an insider.
INTIMIDATION: Threats create compliance. "This is the IRS — failure to respond immediately will result in an arrest warrant." Fear of consequences overrides skepticism.
Phishing, Spear Phishing, Whaling
Marcus moved to the most common delivery mechanism — email.
"Phishing is the mass-market version. An attacker sends millions of emails pretending to be a legitimate organization — your bank, Microsoft, PayPal, the IRS. The emails are generic: 'Dear Customer, your account has been suspended.' Cast a wide net, catch whoever bites. Low targeting, low research investment, low success rate per recipient — but with enough volume, someone always clicks."
"Spear phishing is targeted. The attacker researches a specific individual — their name, employer, job title, manager, recent projects, colleagues. They mine LinkedIn, company websites, social media, press releases. The email they craft references real details the target recognizes. 'Hi Sarah, I'm following up on the Henderson account your team presented last Thursday...' The success rate is dramatically higher because the email appears to come from someone who actually knows the target."
"Whaling is spear phishing aimed specifically at C-suite executives — CEOs, CFOs, CTOs, board members. The name reflects the target: these are the big fish. The research investment is higher, but so is the payoff. C-suite executives can authorize wire transfers, sign contracts, access the most sensitive systems."
"Vishing is voice phishing — phone calls impersonating IT support, the IRS, bank fraud departments. The attacker calls the target and uses the same psychological principles in real time. Caller ID spoofing makes the call appear to originate from any number they choose."
"Smishing is SMS phishing — the same attack via text message. 'Your package delivery requires immediate action: [link].' The short format and mobile context reduce scrutiny."
He paused and looked at the team. "What hit Daniel was whaling plus BEC — the CEO was impersonated to target an executive assistant with financial access. This is textbook."
Pretexting and Impersonation
Marcus walked through exactly how the BEC attack against Daniel had been constructed. It had not been improvised. It had been engineered over weeks.
"Pretexting means creating a fabricated scenario — a pretext — to manipulate the target. The pretext is the story the attacker tells. It has to be plausible, it has to fit the target's known reality, and it has to justify the unusual request."
"Let me show you how they built this one. The CEO's LinkedIn profile showed he was speaking at a conference in Boston this week — the attacker knew he would be unavailable for phone calls. The CEO's Twitter had posts from Boston since Monday, confirming his location and schedule. The company website listed the CFO, the executive assistant by name, and their departmental structure. A press release from eight months ago mentioned the company was exploring 'strategic acquisitions in the logistics sector.'"
"The attacker assembled all of this into a perfect pretext: CEO is traveling, legitimate acquisition context exists publicly, Daniel is the right person to contact, phone is plausibly unavailable. The 'don't tell anyone' instruction had two purposes — it prevented Daniel from checking with colleagues who might have spotted the fraud, and it invoked confidentiality norms that exist in real M&A activity."
"Impersonation extends beyond email. Physical impersonation — dressing as IT support, a facilities contractor, an auditor — gets attackers into buildings. A person in a crisp polo shirt with an IT company's logo, carrying a laptop bag, asking to be let into the server room to 'check the cooling units'... most employees won't challenge them."
He gave another example: a penetration tester had once called the help desk posing as a senior VP. "This is Robert Chen from the executive team. I'm traveling in Singapore and I've been locked out of my account — I need a password reset before my board presentation in two hours. I've got the CEO on hold." Three principles working simultaneously: authority, urgency, and social proof (the CEO is waiting). The help desk reset the account without callback verification."
Physical Social Engineering
Marcus spent time on physical attacks — the category that received the least attention in security training but bypassed all digital controls entirely.
"Tailgating — sometimes called piggybacking — is following an authorized person through a secured door. The attacker times their approach so they arrive just as a legitimate employee badges through. 'Oh, thanks — my hands are full.' The employee holds the door out of courtesy. The attacker is inside."
"What makes tailgating effective is that it exploits deeply ingrained social courtesy. We are trained from childhood not to let doors close in people's faces. An attacker who looks like they belong — dressed appropriately, carrying something, walking with purpose — triggers the 'help this person' response. The cost of being wrong feels low; the social cost of challenging someone feels high."
"Shoulder surfing is passive information capture. Observing someone's screen, keyboard, or documents to capture passwords, PINs, credit card numbers, confidential data. Coffee shops, airports, open-plan offices, public transit — anywhere the target is working in a non-private space. A privacy screen filter costs less than $30 and eliminates this attack vector entirely."
"Dumpster diving means searching through discarded materials for useful information. Organizations throw away extraordinary amounts of useful intelligence: printed org charts with names and reporting lines, network diagrams, old credentials written on sticky notes, financial documents, meeting agendas with project names and dates. An attacker with an org chart and a few internal project names can construct a highly convincing spear phishing campaign from scratch — with apparent insider knowledge."
Quid Pro Quo and Watering Hole Attacks
"Quid pro quo attacks offer something in exchange for information." Marcus described the classic pattern: an attacker calls random employees — not executives, just regular staff — posing as IT support. "Hi, I'm calling from the helpdesk — we've been seeing some unusual activity from accounts in your department and I just need to verify a few things. Can I get you to confirm your username and password so I can check the system on my end?"
"Some employees say no. Some employees hand over their credentials to someone who just offered them help. The attacker offers the appearance of service — IT support — in exchange for access. It doesn't require sophisticated pretexting. It just requires finding the one employee in fifty who hasn't been trained, is having a difficult day, or trusts authority figures without verification."
"Watering hole attacks flip the model entirely. Instead of going to the victim, the attacker compromises a website the victim is known to visit — an industry news site, a conference registration page, a vendor portal, a professional association forum. When the target visits their trusted destination, they're infected. The attacker waits at the watering hole, as predators in nature wait where prey must come to drink."
"This is powerful because no suspicious email is sent. The email security controls are completely bypassed. The victim visits a site they have visited dozens of times, a site their browser has no warning about, and the attack happens at the website layer. The target never did anything suspicious — they just read the news."
"Business Email Compromise — what happened to Daniel — fits here as a capstone. BEC impersonates trusted business contacts: vendor invoices with changed banking details, urgent requests from an executive's account, redirected payroll deposits. Annual losses exceed $2 billion globally. It's not a niche attack — it's the most financially damaging form of cybercrime for organizations."
Defense: Verification and Awareness
Marcus concluded with the question that mattered most in that room: what would have stopped it?
"The single most effective control against BEC is out-of-band verification. Any unusual financial request — any request to wire money, change payment details, override normal procedure — must be verified by a phone call to a number already in your system. Not to a number in the email. Not to the executive's mobile number as provided in the message. A call to the number in your corporate directory, a number you have independently verified."
"In this case: Daniel should have called the CEO's known number — the one in the contacts system — regardless of what the email said about being in meetings. A real CEO, asked to confirm a $185,000 wire transfer, will take the call. If the CEO doesn't pick up, the wire transfer waits."
"Dual authorization is the process control version of this. Large wire transfers require two separate approvals from two separate people in two separate channels. One person can be deceived. Two people independently verifying through independent channels are almost impossible to simultaneously deceive."
"Security awareness training gives employees the pattern recognition to spot the attack before it completes. When employees know what a BEC attack looks like — know that Authority + Urgency + Secrecy is the signature combination — they can pause and ask: 'Is this the pattern I was trained to recognize?' Training doesn't eliminate attacks, but it dramatically reduces the window in which they succeed."
"And the reporting culture matters enormously. Daniel needs to know that reporting a suspicious email he almost acted on is the right professional behavior. If Daniel had called the CEO's real number and discovered the fraud before the wire was sent, that would have been a success — not a near-miss he should be embarrassed about. We celebrate the catches."