It Only Takes One Phish: Puerto Rico Gets Scammed Out of $2.6 Million

Skyline of San Juan, Puerto RicoOnce again, it was the human factor and skilled phishing tactics from the bad guys that was responsible for such a material loss. And, from the sound of it, policy and procedure either weren’t in place or weren’t followed.

This is a very simple tale; in fact, so simple, it sounds like all the attackers used was a single email. Reports of one of the agencies of the Puerto Rican government, the Industrial Development Company, transferred the millions on January 17th. According to news reports, a simple email purporting to be a contractor was received requesting a change to banking details for payment remittance.

The FBI’s Recovery Asset Team is now involved and is working to attempt to recover the funds.

Anytime emails are sent asking for any kind of information or changes made involving bank accounts, transactions, and transfers, organizations need to protect themselves proactively:

  • Establish a policy that mandates all requests be validated using an alternative medium, such as in-person or over the phone.
  • Users whose roles have them even marginally involved with money-related transactions should undergo Security Awareness Training to both understand that these types of scams occur regularly and how they can spot a suspicious email before the damage is done.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Ransomware Has Gone Nuclear Webinar

Get the latest about social engineering

Subscribe to CyberheistNews