View the full-size version of this graphic
Five Social Engineering Scams Costing Companies Millions
A fake CEO video call cost one company $25 million. Another phishing attack helped steal $81 million from a bank. As AI-powered impersonation and digital fraud become more convincing, social engineering scams are costing businesses millions.
This graphic, created in partnership with Inigo, highlights five of the most common tactics used by cybercriminals today. While social engineering takes many forms, it relies on the same principle: tricking people into revealing information or authorizing actions.
1. Deepfake Impersonation
Criminals use AI-generated audio or video to impersonate executives or colleagues. As deepfake technology improves, traditional verification methods like phone calls or video meetings are becoming less reliable.
Real-World Example: UK engineering firm Arup lost $25 million when fraudsters posed as managers on a video call and convinced an employee to transfer money.
Key Fact: People can only detect deepfakes 55% of the time on average.
2. Vendor Spoofing
Fraudsters pretend to be a real supplier and change payment details so a legitimate invoice gets paid to a criminal account.
Real-World Example: Google and Facebook lost more than $120 million after a man impersonated hardware manufacturer Quanta Computer and requested funds be sent to bank accounts he controlled.
Key Fact: On average, companies say they had 9 successful cases and 13 attempted cases of vendor spoofing in a year. The typical loss per incident in the U.S. amounted to $133,000.
3. SIM Swap
The attacker hijacks the victim’s phone number so one-time passcodes and password resets go to the criminal instead.
Real-World Example: A hacker used a SIM swap to take control of a phone number linked to the SEC, and then hijacked the official X (Twitter) account to post false market information.
Key Fact: In a study of five major U.S. wireless carriers, 78% of first attempts at SIM fraud were successful.
4. Phishing
A fake email, text, or website tricks the target into clicking, logging in, or opening malware, which gives the attacker a foothold.
Real-World Example: Bangladesh Bank lost $81 million when hackers sent job application themed phishing emails with malicious attachments to employees.
Key Fact: U.S. phishing losses have climbed from $19 million in 2023 to $216 million in 2025.
5. Executive Impersonation
Fraudsters pretend to be a senior executive and pressure staff into making urgent, secret payments outside normal controls.
Real-World Example: Crelan Bank lost about $76 million when a hacker posed as the CEO via email and requested employees send funds to an account they controlled.
Key Fact: Globally, 58% of companies have had cases of executive impersonation scams via text or voice.
How Social Engineering Is Reshaping Modern Fraud
Fraud goes far beyond exploiting technical system weaknesses. Often, criminals are manipulating human trust to bypass security controls through phishing, impersonation, and other forms of social engineering.
As AI becomes more advanced, these scams are becoming more convincing, scalable, and difficult to detect. Companies are facing new challenges managing fraud risk in an increasingly digital world.