Hacker News Reader

Comment by beamatronic | Hacker News Reader

Does this mean an employees of the company got an email from someone posing as their boss, or their CEO, instructing them to wire $46 million dollars, and they simply...did so? without asking any questions?

View on HN

It's usually a finance dept person who gets an email like this and yes it's a possibility. A CEO/boss sounds like they're in charge and it's sometimes very difficult to question orders.

I heard a story that at one place the only reason they didn't scammed is because the accountant walked over to the CEO to double-check the instructions of the wire transfer. It's easy to imagine what would have happened if the wire transfer instructions were correct!

That makes it sound strange. The reality is the finance dept responded to routine requests for wire transfers similar to all the others the handle all day, every day.

Yes. Basically.

I've seen similar attacks before, granted for lower amounts, but in many companies, finance departments sending out wires for many hundreds of thousands of dollars is a common operation -- suppliers, contracts signed, and everyone wants their wire transfer to be done ASAP.

Get an email from the CFO/CEO/SVP of X saying to wire money for contract Z ASAP, and action will be taken.

Sounds like cryptographically signing emails is not such a bad idea after all...

Sounds like taking transfer orders via email at all is still a bad idea after all...

This is why Estonia's e-residency program focus on authentication and digital signing. It should be harder to steal a crypto key no?

Yeah, except it's also possible, and not unusual, to compromise the cfo or someone's email/computer and then send signed emails all day.

At my company any email request like that is verified by a phone call. (Don't know if that would have helped here).

It was likely multiple smaller wires, but yes, that's basically what happened. Big companies wire a lot of money a lot of places.

Reply on news.ycombinator.com