Case 02
The Hijacked Callback
A title agency was held liable for $1,500,000 after relying on wire instructions retrieved from a compromised callback sheet.
Connelly v. Cowbell Cyber (W.D. Wash. 2025)
Documented Loss
$1,500,000
The point of these briefs is not spectacle. It is to show how thin the fallback assumptions become once the wire is already in motion.
What Failed
The office followed a callback protocol, but the protocol was sourced from the same compromised channel as the wire instructions.
What The Case Proves
A callback is not enough if the attacker controls both the email and the number. The verification channel itself has to be independent.
Why Veto Exists
Veto’s job is to create a separate verification event and a record that the desk checked the destination before release, not simply to add one more phone call.