An $81,000 Invoice Redirected. Converge Made Them Whole.

The Incident

A heating and cooling services provider discovered that a threat actor had contacted one of its customers and successfully redirected an $81,000 payment to a fraudulent bank account.

The attacker had been inside the insured's email system, silently monitoring communications and waiting for the right moment. When a large invoice was due, the attacker impersonated the insured and sent revised payment instructions to the customer. The customer paid in good faith. The money went to the wrong account.

This type of attack, often called invoice manipulation or business email compromise (BEC), is one of the most financially damaging cyber threats because the money is often unrecoverable once it leaves the account.

The Response

Converge engaged IR panel vendors for digital forensics and legal consultation. The investigation revealed the attack was far broader than a single intercepted invoice. Thirteen employee email accounts had been accessed by the threat actor through phishing.

A Converge panel vendor conducted data mining on the contents of all 13 compromised accounts and identified 261 individuals whose personal information may have been exposed. Notification letters were sent and credit monitoring was provided.

Meanwhile, the insured's customer attempted to recover the misdirected $81,000 from the fraudulent account but was unsuccessful. The money was gone.

The Outcome

Converge made the insured whole. The $81,000 financial loss was covered through Invoice Manipulation/Cyber Crime Coverage. All 261 affected individuals were notified and provided credit monitoring.

Total claim cost came to approximately $141,000 across forensics, legal, notification, monitoring, and the covered financial loss. Without the coverage, the insured would have absorbed the $81,000 with no path to recovery, on top of the cost of the investigation and notification.

Key Takeaway

Invoice and payment redirection attacks are among the most financially damaging forms of email compromise. The money often cannot be recovered once transferred. Enable MFA on all accounts, train employees to verify any payment changes by phone using a known number (not the one in the email), and make sure your cyber policy includes invoice manipulation and cyber crime coverage. When this happens, it is almost always unrecoverable without it.