Cyber Story #001
The Day 1.5 Million Left the Bank in 47 Seconds
Estimated reading time: 6 min
Monday. 08:43 AM.
The finance team had already processed dozens of payments that morning.
Invoices.
Suppliers.
Payroll.
Everything looked normal.
Then an email arrived.
It came from the CEO.
Or at least...
that's what everyone believed.
The message was short.
"Morning.
I need this payment processed urgently before the meeting starts.
I'll explain later.
Thank you."
Attached was an invoice.
Nothing unusual.
The company name was familiar.
The logo looked correct.
The signature matched previous emails.
Even the writing style felt right.
The finance manager checked the amount.
Large.
But not impossible.
The CEO had approved larger payments before.
Without thinking twice...
the transfer was authorised.
Forty-seven seconds later...
1.5 Million was gone.
Then the phone rang.
It was the real CEO.
"I never sent that email."
Silence.
The room froze.
Everyone opened Outlook.
Everyone looked again.
Everything suddenly looked different.
The sender's address wasn't exactly the same.
One letter.
One tiny difference.
Nobody noticed it before.
The bank tried to stop the payment.
Too late.
The money had already moved through multiple accounts.
Within minutes...
it disappeared.
What Actually Happened?
This wasn't a sophisticated hack.
Nobody broke into the company's network.
Nobody guessed a password.
Nobody installed malware.
The attackers simply understood one thing better than anyone else.
People trust what looks familiar.
This type of attack is commonly known as Business Email Compromise (BEC).
Instead of attacking computers...
criminals attack decisions.
They copy logos.
They imitate writing styles.
They register domains that look almost identical.
They create pressure.
And then they wait for somebody to act before thinking.
Why It Worked
The email arrived during a busy morning.
The request sounded urgent.
The sender looked legitimate.
The payment amount wasn't unusual.
Nobody wanted to delay the CEO.
No one made a quick verification call.
Forty-seven seconds was all it took.
Could This Have Been Prevented?
Yes.
Not with expensive technology.
With simple habits.
Verify unusual payment requests by phone.
Check the sender's full email address not just the display name.
Require approval for high-value transfers.
Train staff to recognize social engineering.
Protect business accounts with multi-factor authentication.
Use secure email and document verification processes.
Cybersecurity is often less about defeating hackers...
and more about slowing down just enough to ask:
"Does this actually make sense?"
The Lesson
Most cyber incidents don't begin with advanced hacking.
They begin with ordinary people making ordinary decisions under pressure.
Technology matters.
Processes matter.
But awareness is still your strongest defense.
