Internal threats: the impact of elicitation

Internal Threats: The Impact of Elicitation

The Public Transportation Authority (EMT) of Valencia, Spain, suffered a €4 million scam through elicitation techniques targeting a senior executive — a case of CEO fraud, a form of social engineering based on psychological manipulation.

What Is Elicitation?

From the Latin elicitus (“induced”) and elicere (“catch”), elicitation in psychology refers to the smooth transfer of information from one person to another through conversation.

In information security, it refers to techniques attackers use to obtain sensitive information or manipulate victims into actions that result in data leaks or direct economic losses — as in this case.

The Incident

The victim, a director at EMT Valencia for 35 years, was dismissed immediately after authorizing eight transfers in less than three weeks from the company’s Caixabank account to a Bank of China account in Hong Kong.

These transfers:

• Totaled €4,040,000.
• Did not correspond to any authorized payment for supplies or services.
• Violated EMT’s internal payment authorization protocol.

How the Scam Worked

The main hypothesis is that the executive was a victim of an international CEO fraud scheme:

1. A top manager receives an email appearing to come from the company’s president or senior official.
2. The message contains urgent instructions to transfer a large sum to an external account, often framed as part of a confidential acquisition or deal.
3. The victim, under pressure and secrecy, complies without following standard verification procedures.

In this case, the false email appeared to come from the Minister of Sustainable Mobility, ordering the purchase of a company in China under strict confidentiality.

Lessons Learned

It is essential to know employees’ degree of vulnerability — due to psychological traits or lack of awareness — against elicitation techniques.

Elicitation is one of the 10 risk types identified by Kymatio to strengthen employees and prevent insider incidents.

More Information

• El País (Spanish) – Valencia public company loses €4 million in scam
• Wikipedia – Elicitación

To prevent internal risk and strengthen employees, contact Kymatio.