This is a crazy story about how they stole almost a million
dollars from us and got away with it.
So, I work for a very big tech company, and one of our suppliers
who's located overseas sends me an email about an invoice
asking me to pay to a different bank account.
Now, I've done my security awareness training and this is
one of those things that immediately raises a red flag.
I was concerned that somebody spoofed his email.
So instead of replying to that email, I composed a brand
new email, made sure it was the correct address, and sent
it to my supplier.
I wrote, "Hey Dave, I just got this weird email about wiring
to a different bank account,
was that you?". He was like, "Yeah, that was me."
But, I was still a little suspicious.
So I asked Dave if we could talk on the phone.
Dave said, "Sure, no problem."
So I called Dave.
He confirms that it was him who sent the email.
I hang up, transfer the money, only to find out I got scammed.
You want to know what happened?
Well, I made one very small but critical mistake.
I called Dave on the phone number that was listed in his
email signature.
But Dave's email was hacked, and the scammer changed Dave's
email signature to show their phone number.
And it was the scammer who answered the phone when I called
and not Dave.
The thing is, I honestly did not even think about a scenario
where Dave's email would be hacked.
That's why it's not only really important that you call and
verify, but you're calling the phone number that's listed
in your system, especially if you're suspicious
right off the bat.