The Most Expensive Click

Susan, the office manager for a 35-person manufacturing company, was trying to clear her inbox before heading home. Her son’s baseball game started in an hour, and she was determined not to be late again.

Then she saw it.

Subject: Updated ACH Payment Information Needed

The email appeared to come from one of their largest vendors.

• The logo was correct.
• The signature looked right.
• The writing style matched previous emails.

The message explained that the vendor had recently changed banks and needed future payments sent to a new account.

Susan glanced at it for maybe ten seconds.

• The timing made sense.
• The request seemed reasonable.

She forwarded it to accounting with a simple note:

“Please update before next week’s payment run.”

• Nobody questioned it.
• Nobody called the vendor.
• Nobody verified the change.

Three days later, the company sent $187,000 to a criminal’s bank account.

The vendor called two weeks later.

“Hey, we’re checking on invoice payment. It shows as unpaid.”

At first, everyone assumed it was an accounting mistake.

Then panic started spreading.

• The payment had cleared.
• The money was gone.
• The bank confirmed it had been transferred multiple times and moved overseas.
• Recovery chances were slim.

The investigation revealed something even scarier.

The criminals hadn’t hacked the manufacturing company.

They had hacked the vendor months earlier.

• They quietly monitored email conversations.
• They learned who approved payments.
• They learned invoice schedules.
• They learned writing styles.
• They waited.

Then, at exactly the right moment, they inserted themselves into an existing conversation and sent a perfectly timed request.

• No malware.
• No ransomware.
• No sophisticated exploit.

Just trust.

The owner later asked the cybersecurity consultant:

“How could we have stopped this?”

The answer was painfully simple.

A 30-second phone call.

That’s it.

One person picking up the phone and saying:

“Can you confirm these banking changes?”

The entire incident would have been avoided.

Here’s the part that always sticks with me.

After everything was over, Susan said:

“I knew we were supposed to verify banking changes. I remember covering it in training. I just wasn’t thinking about security. I was thinking about getting through my inbox.”

That’s the reality of cybersecurity.

Most breaches don’t happen because people don’t know better.

They happen because people are:

• Busy.
• Distracted.
• Tired.
• Rushing between meetings.
• Trying to leave for a baseball game.

And for just a moment, they stop thinking like a security professional and start thinking like a human being.

That’s why security awareness training can’t be a once-a-year event.

Because the enemy isn’t ignorance.

It’s forgetting.

And sometimes the scariest cybersecurity story isn’t about hackers breaking in.

It’s about a completely normal employee having a completely normal day and making one completely understandable mistake.