Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →In March 2020, fraudsters diverted a Norfund loan intended for a Cambodian microfinance institution to a bank account in Mexico. Norfund said the scammers manipulated communications and forged payment details; PwC later described a compromised employee email account, fake domains and impersonation. The case shows why a convincing email thread or familiar account name cannot verify changed bank details.
What happened to Norfund’s $10 million?
Norfund, Norway’s development finance institution, said on 13 May 2020 that fraudsters redirected a loan of USD 10 million—approximately NOK 100 million—intended for a microfinance institution in Cambodia. The transfer took place on 16 March 2020 and went to an account in Mexico. Although the account holder used the intended institution’s name, it was not that institution, Norfund said. Norfund’s 13 May statement described the incident as a serious fraud connected to an advanced data breach.
As an Amazon Associate I earn from qualifying purchases.
PwC’s 2021 retrospective gives the exact transferred amount as USD 9,888,055. That figure is PwC’s account of the transaction; Norfund’s public statement rounded the loss to USD 10 million. PwC’s retrospective says the employee account had been compromised in September 2019 and monitored for seven months.
How did the attackers make the payment seem legitimate?
According to PwC, the attackers intercepted correspondence about the forthcoming transfer on 9 March 2020, changed bank details in a disbursement notice, registered fake domains and impersonated Norfund and LOLC employees in conversations. They used the existing business relationship and its communications to make fraudulent instructions resemble normal correspondence. Norfund said the fraudsters manipulated and falsified communications over time and forged documents and payment details.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
PwC also says the attackers used COVID-19 to explain the delayed transfer to LOLC while sending Norfund messages that suggested LOLC had received the money. On 24 April, a related attempt to redirect a payment to another Cambodian client was challenged: a Norfund investment manager checked directly with First Finance, which said the proposed account was not theirs. On 30 April, LOLC told Norfund that the March transfer details were wrong. Norfund then engaged PwC’s incident-response team, according to PwC.
Norfund said it discovered the fraud on 30 April, when scammers made a further attempt that the organization detected and prevented. This later attempt was separate from the completed March transfer.
Rank #2
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
What Norfund did—and what remains unknown
Norfund said it established a crisis management team, informed its owner, Norway’s Ministry of Foreign Affairs, contacted police, and cooperated with DNB and other authorities. It halted all payments and began a systematic review of internal routines and controls. Its board also commissioned PwC to evaluate the company’s routines and security systems independently.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsNorfund’s 13 May 2020 statement said the investigation was ongoing and many details still needed to be examined. It did not identify the initial entry method, name a perpetrator or establish whether the money was later recovered. PwC’s account adds details about a compromised employee account and fake domains, but these should be understood as PwC’s retrospective findings—not details in Norfund’s initial release. The available accounts do not establish that an initial phishing email caused the compromise.
Rank #3
- XGS 118 with 1 Year Xstream Protection - Next-generation firewall appliance with Xstream Protection subscription providing zero-day defense, cloud sandboxing, email filtering, intrusion prevention, and advanced reporting, managed through Sophos Central for unified policies and reporting.
- 9 x 2.5 GE copper ports and 1 SFP fiber port, delivering up to 15.5 Gbps firewall performance for mid sized organizations.
- Zero day protection with cloud sandboxing, email filtering, and advanced reporting for full enterprise coverage.
- TLS inspection and next generation intrusion prevention block hidden threats in encrypted traffic and stop sophisticated attacks.
- Includes Xstream Protection – Advanced security bundle with zero-day protection, cloud sandboxing, email filtering, and automated threat response, providing full coverage against the most sophisticated cyberattacks.
What businesses can learn from the fraud
The essential lesson is that email is not a safe verification channel for a change to payment instructions. A genuine-looking thread, matching documents, familiar names or an account holder name that resembles the intended recipient cannot independently confirm that the bank details are valid. Attackers who can monitor a real business relationship may know enough context to make a fraudulent request appear routine.
The FBI’s general business email compromise guidance recommends several controls. They address different failure points and work best as parts of an organization-wide payment process; no single measure is shown to have prevented Norfund’s loss.
Rank #4
- INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 3 years of FortiCare Premium, and FortiGuard Unified Threat Protection.
- UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
- IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
- CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
- COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.
| Control | What it addresses | What it does not establish |
|---|---|---|
| Independent, out-of-band confirmation | Checks a new or changed payment instruction through a trusted contact method already on file, rather than relying on contact details in the email requesting the change. | Email or a familiar account name alone does not prove the destination account belongs to the intended recipient. |
| Two-step verification and dual approval for transfers | Adds another check to payment procedures, especially for high-value or changed instructions. Approval responsibilities should be clear and separate where practical. | Approval of a request is not the same as independently validating the recipient’s bank details. |
| Email and domain protections | Help teams spot lookalike domains and suspicious messages; the FBI also advises watching for urgency or secrecy. | Email authentication or security controls cannot, by themselves, validate that a legitimate-looking payment instruction is genuine. |
The FBI’s guidance advises organizations to confirm payment requests and changes to vendor payment locations, use two-step verification for wire-transfer procedures and watch for lookalike domains. If a transfer may have been diverted, the FBI advises victims to contact their financial institution immediately and file a complaint with law enforcement. Read the FBI’s business email compromise guidance.
Why the Norfund case still matters
This was not simply a case of a single suspicious message being missed. PwC describes a long period of access to an employee email account followed by targeted impersonation around a specific transaction; Norfund described prolonged manipulation of communications. That combination helps explain why payment controls need a verification path outside the email conversation itself.
Norfund’s CEO, Tellef Thorleifsson, later reflected in the organization’s 2020 annual report: “This was a grave incident that we deeply regret. The fraud clearly showed that in our active use of digital channels we, as an international investor and development organisation, are vulnerable.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
