NO, I’M NOT A PHISHERMAN, I’M AN EMPLOYEE … NO, WAIT, I’M THE CEO. YEAH, THAT’S THE TICKET! NO REALLY, SO PLEASE SEND $46.7 MILLION ASAP!

phonecaller

That sure sounds like a line from pathological liar Tommy Flanagan, a character played by funnyman Jon Lovitz on Saturday Night Live back in the day. But it turns out that may have been pretty much what happened to Ubiquiti Networks Inc. 

In a recent SEC filing, San Jose-based Ubiquiti revealed that an “employee impersonation and fraudulent requests from an outside entity targeting the Company’s finance department” resulted in the transfer of $46.7 million from a Hong Kong subsidiary to third-party overseas accounts. The network services company said it first learned of the fraud June 5. 

Data security guru Brian Krebs describes that kind of attack as “CEO fraud.” Although Ubiquiti didn’t provide further details about exactly what happened in the scam it faced, Krebs says CEO fraud “usually begins with the thieves either phishing an executive and gaining access to that individual’s inbox, or emailing employees from a look-alike domain name that is one or two letters off from the target company’s true domain name. For example, if the target company’s domain was ‘example.com’ the thieves might register ‘examp1e.com’ (substituting the letter ‘L’ for the numeral 1) or ‘example.co,’ and send messages from that domain.”

Ubiquiti said it has managed to recover $8.1 million of the improperly transferred funds and expects to regain another $6.8 million that is subject to an injunction. But that leaves the company and law enforcement agencies chasing a not insignificant $31.8 million.

To keep up with the constantly evolving world of privacy and security sign up for the Bloomberg BNA Privacy and Security Update.