Cyber Tales: The Fake Vendor Scam

Enter: The Hackbusters Team 

After talking with Finance Colin, Alison knew she needed to talk to someone else next. Thankfully, Tower Tutors had been a BOXX Insurance client for years. Alison considered cyber security as essential as a business license and had made a point of understanding her policy and meeting with the BOXX vCISO to review TT’s position. She called BOXX’s Hackbusters team. 

Within minutes, she was speaking with Jack Brooks, BOXX’s virtual Chief Information Security Officer (vCISO) and Head of Hackbusters.

“I was in my dad’s study,” Alison remembers. “Using the phone I used to talk to childhood friends, trying to explain how we’d just wired a quarter of a million dollars to cybercriminals. It was surreal.” 

Jack understood immediately. 

“No security breach,” Jack said after a quick analysis. “This is a classic business email compromise. No one hacked your system. They tricked your finance department with social engineering.” 

Alison exhaled. “So, the tutors…our students…their data is safe?” 

“Yes,” Jack reassured her. “And if we act fast, we might be able to recover some of your money.”

“I Contemplated Life on the Run” 

Colin stared at his phone, panic rising. 

“I’m not going to lie,” Colin says now, “There was a moment—a brief one—where I contemplated life on the run. A new identity. A beach somewhere.” 

Knowing there is no need to feel cyber shame, it was time for Colin to focus on solutions. He braced himself for Alison’s call.

When the phone rang, it was surprisingly calm and even more surprising—not from Alison.  

Jack Brooks was on the line, and he wanted to help.  

“I had a Chief Information Security Officer on the phone, telling me that we might be able to fix this,” Colin recalled. “But only if we got to work. Five minutes ago.” 

He wasn’t just saying this for dramatic effect—time was of the essence. Once money is wired, recovery is a race against the clock. The longer they waited, the lower the chances of getting any of it back. 

The Race Against Time 

Jack outlined the plan. The funds had been wired out, but banks could sometimes halt fraudulent transactions if they were contacted quickly. But there was a problem—banks move at their own pace, and Colin was getting stonewalled by well-meaning but slow-moving gatekeepers. He might not be great at spotting scams, but he knew finance. He could speak their language, he just needed to get to the right people, right away.

Jack had a strategy and wrote up a summary of the event, with details of what happened – making it easier for Colin to explain the situation clearly to the bank. 

“Be persistent. Call every hour. Get to a decision-maker and make sure the fraud department understands the timeline and that authorities have been notified.” 

Colin, determined to undo his mistake, followed the advice to the letter. He refused to be brushed off, escalating to managers and fraud departments. And it worked. 

By the next morning, four of the five payments had been recovered. 

But there was bad news. The first payment—$48,000—had been transferred to a bank overseas and was not recoverable.

Lessons Learned 

The cyber thieves didn’t hack into Tower’s systems—they hacked into human psychology.  

“The criminals used urgency, authority, and fear to cloud Colin’s judgment.” Jack explained. “The email looked official, carried legal pressure, and played on the fact that Alison was unavailable. That’s social engineering at its best. These scams are designed to make even experienced professionals act before they think.” 

“It’s disappointing that the criminals profited,” Jack admitted, “but considering the total loss could’ve been $250,000, things could have been much worse.”

Alison agreed. “Losing any money hurts, but thanks to BOXX, it wasn’t catastrophic. I didn’t have to spend my bereavement leave fixing a financial disaster.” 

In the aftermath, Tower Tutors takes cybersecurity more seriously than ever. 

Every employee—from finance to HR—was enrolled in BOXX Academy’s cyber awareness training. Hackbusters also helped them implement a multi-step payment verification process to prevent this from happening again. 

And Finance Colin? 

“I knew my job wasn’t at risk,” Colin says, “but I felt like I needed to make up for what happened. Alison was an incredibly supportive boss. She even took responsibility for not communicating about changing law firms. I wanted her to know that I’d learned from my mistakes. So, I took the lead on making sure we locked down our payment processes for good.” 

Now, if an email comes in demanding money, Tower Tutors verifies it with a phone call—every time. 

“I wish I’d done that in the first place,” Colin admits. “And about a dozen other things differently. But, hey, at least IT Colin and I finally have something to bond over besides the coffee machine.”

Cyber threats don’t always come from hacks—they come from human errors and clever deception. Thanks to BOXX and Hackbusters, Tower Tutors recovered most of their losses and turned a costly mistake into a valuable lesson. 

Could your business detect a scam before it’s too late? If not, maybe it’s time to call BOXX.

Interested in more real-life cyber stories?
Sign-up for the BOXX Newsletter today.

Join over 5,000+ others that receive our newsletter updates. Filled with expert advice and product announcements to help prevent a cyber incident. Get insider access to news around BOXX innovations, cyber tips and case studies that allow you to stay up to date on all things cyber.