Non-profit · 2017
Save the Children: payment fraud case
$1M for solar panels that never existed.
What happened
In April 2017, attackers used a Save the Children employee's email account to submit false invoices and supporting documents for a plausible project: solar panels at health facilities in Pakistan. The request followed a familiar business context, and the organization transferred $997,400 to a fraudulent entity in Japan.
The fraud was discovered about a month later, too late to recall the transfer. Insurance reduced the final loss, and the incident became public through the organization's tax filing. The payment platform did not need to be hacked; control of a trusted mailbox was enough to move a convincing request through the normal approval process.
What would have changed it
A familiar sender and a plausible project are not payment verification. We protect mailboxes and train finance teams to confirm beneficiaries outside the email thread.