$600,000 Stolen Over the Phone. $500,000 Recovered.

The Incident

No malware. No hacked servers. This attack was entirely human.

Executives at a medical support services provider began receiving phone calls that appeared to come from their bank's fraud department. The caller ID was spoofed to match the bank's real number. Over a 2 to 3 week period, the threat actor built an increasingly convincing story: the company's bank account had been compromised, and the executives needed to take immediate action to secure it.

In reality, the account was fine. But through a series of carefully orchestrated calls, the executives were manipulated into sharing enough security credentials and verification codes for the attacker to gain actual access to the account. Once inside, the threat actor initiated 11 wire transfers totaling nearly $600,000.

The Response

Speed made the difference here. The insured contacted its bank and Converge as soon as the fraud was discovered. Converge engaged panel IR firms for digital forensics and legal support, but the most critical action was getting into the financial fraud kill chain.

This is a time-sensitive process. Converge worked with the insured to gather wire transfer details, recipient account information, and transaction records, then coordinated with law enforcement and the receiving financial institutions to freeze and claw back funds before they could be moved or withdrawn. Every hour that passes makes recovery less likely.

The Outcome

Over $500,000 of the $600,000 was recovered through the fraud kill chain. The remaining loss of approximately $90,000 was paid by Converge through Social Engineering/Cyber Crime coverage.

Without the rapid response from the insured and Converge's immediate coordination with financial institutions, the full $600,000 would have been gone. In wire fraud, recovery rates drop dramatically after the first 24 to 48 hours.

Key Takeaway

No technology could have prevented this attack. It was a human problem. The fix is training: never share sensitive security information with anyone who calls you, no matter how legitimate the caller ID appears. Hang up and call the number you know to be real. And when fraud is discovered, notify your bank and your carrier immediately. Speed is everything.