The Holiday Scam That Cost One Company $60 Million

A well-documented case involved a company losing tens of millions of dollars to a sophisticated business email compromise scheme during the holiday season - a stark reminder of how costly a single successful social engineering attack can be.

How the Scam Unfolded

The attack followed a familiar pattern: attackers researched the company's structure and vendor relationships, then impersonated a trusted executive and vendor contact to request a series of wire transfers, timed to exploit the reduced verification vigilance common during the holiday season.

The Key Failure Points

• •Payment requests were processed without independent verification through a known, separate channel.
• •The urgency and authority conveyed in the fraudulent messages discouraged the kind of scrutiny that might have caught inconsistencies.
• •Multiple transfers were processed before anyone recognized a pattern, rather than a single transaction triggering review.

Lessons for Minneapolis Businesses

• •No payment request should be processed based on email alone, regardless of who it appears to be from.
• •Verification protocols need to survive urgency and seniority pressure - the more urgent and high-authority a request seems, the more scrutiny it deserves, not less.
• •Multiple transactions in a short window should trigger automatic review, especially involving new payment details.

Building Real Protection

This kind of loss is almost always preventable with a simple, consistently enforced rule: any payment or banking detail change requires verbal confirmation through an independently verified phone number, no exceptions regardless of urgency or seniority.

Veracity Technologies helps Minneapolis-St. Paul businesses build the verification protocols that prevent catastrophic business email compromise losses like this one.