An organization can invest heavily in cybersecurity and still lose money if a legitimate user is deceived into doing what a fraudster wants. This is where the human side of cyber fraud begins.

Criminals do not always need to break into a system. Instead, they may manipulate the person who already has access, authority, or information.

Strong cybersecurity controls remain essential. However, systems alone cannot protect an organization when an authorized person is persuaded to misuse access or bypass verification.

Five Takeaways for Boards and Management

1. Cyber-enabled fraud can succeed without defeating the underlying technology if an authorized user is manipulated into acting.
2. Fraudsters often exploit authority, urgency, confidentiality, familiarity, and fear to influence human judgment.
3. Strong authentication does not eliminate fraud risk when the authenticated person acts on a fraudulent instruction.
4. Employees should be expected and supported to stop, verify, and question unusual requests involving money, credentials, access, or sensitive information.
5. Controls should be designed so that no single convincing message, call, or apparent instruction can authorize a high-risk transaction.

A Familiar Cyber Fraud Scenario

A finance employee receives an email that appears to come from the CEO. It refers to a confidential transaction and instructs the employee to transfer funds urgently. The employee is told not to discuss the matter because only a small group knows about it.

The name is correct. The message appears familiar. The request carries authority and urgency.

The employee has legitimate access to the payment system and is authorized to initiate transactions.

Nothing necessarily needs to be technically broken. Instead, the fraud succeeds if the employee is persuaded to use legitimate access in response to a fraudulent instruction.

Cybersecurity and Anti-Fraud Governance Ask Different Questions

That distinction matters because the system may recognize valid credentials but still be unable to determine whether the person using them has been deceived.

When Phishing Captures Trusted Access

According to the U.S. Department of Justice (2021), an executive at Unatrac Holding Limited fell victim to a phishing email in April 2018, enabling conspirators to obtain login credentials and submit fraudulent wire-transfer requests supported by fake invoices. The DOJ reported that fraudulent wire transfers associated with the effort to victimize Unatrac totaled nearly US$11 million. The DOJ further reported that Obinwanne Okeke pleaded guilty and was sentenced in 2021 to 10 years in prison.

When Apparent Authority Replaces Verification

According to the U.S. Department of Justice (2018), Adeyemi Odufuye and others were involved in emails sent to the controller of a company in Torrington, Connecticut, that appeared to originate from the company’s CEO and requested wire transfers. The DOJ reported that the company made five transfers totaling more than US$500,000. The DOJ further reported that Odufuye pleaded guilty and was sentenced to 45 months in prison.

Competent Questioning before Action

This is precisely where Competent Questioning becomes operational (Masoud, 2026). Before acting on an unusual digital instruction, employees should ask:

Five Controls Organizations Should Consider

1. Require independent verification for material or unusual instructions involving payments, account changes, credentials, access, or sensitive information.
2. Do not verify a questionable instruction through the same channel that delivered it.
3. Require additional verification for changes to beneficiary or payment instructions.
4. Separate initiation from authorization where transaction risk warrants it.
5. Give employees explicit authority to stop and question unusual requests without fear of penalty for reasonable verification.

What Boards Should Ask

Boards should ask:

And:

One Hard Takeaway

References