Unatrac lost nearly $11 million after thieves used its CFO’s mailbox to push fake supplier wires

Unatrac Holding Ltd. — a U.K. Caterpillar-linked export office — lost nearly $11 million after thieves used its CFO’s real mailbox to push fake supplier wires. On April 1, 2018, the CFO clicked a phishing link that opened a fake Microsoft Office 365 login page and typed in his credentials.

Between April 6 and April 20, attackers accessed that account hundreds of times, mostly from Nigerian IP addresses. From inside the real mailbox, they sent wire requests to Unatrac’s finance team and propped them up with fake supplier invoices forwarded as if the CFO had approved them. Filter rules hid the finance team’s replies from the real CFO. Finance processed 15 payments to overseas accounts totaling nearly $11 million. Most of it was gone by the time the company caught on. The same operation also hit Red Wing Shoe Company for about $108,000 in early 2018. Obinwanne Okeke later pleaded guilty and was sentenced to 10 years in U.S. federal court for his role in the wider scheme.

A real inbox in the wrong hands beats a clever subject line. If wires only move after a second person confirms on a known phone line, this pattern breaks.

If you want a plain read on whether strangers can email as your company — spoofcoach.com. Free.