Comerica Phish Foiled 2-Factor Protection
Summary: A Michigan metals supply company, Experi-Metal Inc., is suing Comerica Bank after an employee fell for a phishing email on Jan. 22, 2009 that spoofed the bank and captured both the company's online banking credentials and the code from its security token. Attackers then initiated 47 wire transfers to China, Estonia, Finland, Russia and Scotland between 7:30 a.m. and 10:50 a.m., and another 38 wires over the following three hours after EMI asked the bank to stop, for a loss of more than $560,000.
Key Takeaway: EMI had requested just two wire transfers in the prior two years, yet 85 fraudulent wires moved in a single morning - and the token code the phishers captured kept the session alive long enough to keep sending them after the fraud was reported.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026