{"id":70151,"date":"2026-08-21T19:15:53","date_gmt":"2026-08-21T17:15:53","guid":{"rendered":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/"},"modified":"2026-09-17T14:55:41","modified_gmt":"2026-09-17T12:55:41","slug":"89-million-euro-loss-ict-risk-controls-dora","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/","title":{"rendered":"EUR 89 Million in Losses: What ICT Risk Controls Miss"},"content":{"rendered":"<div id=\"sgce-a\" class=\"sgce-article\">\n<p class=\"rc-lede\">The Oesterreichische Nationalbank recorded total payment fraud of EUR 115.4 million for 2025, an increase of 17.6 percent over the previous year. Wire transfers accounted for only nine percent of fraud cases, yet caused around EUR 89 million, or 78 percent of total losses. Social engineering attacks, in which victims authorise the payment themselves, were responsible for 83 percent of these cases. For ICT risk controls under DORA, this holds a lesson that control documentation alone does not reveal.<\/p>\n<div class=\"rc-tldr\">\n<div class=\"rc-tldr-label\">In short<\/div>\n<p>A recent fraud report shows that social engineering attacks on wire transfers are rare but especially costly. The lesson for the control landscape: documented controls such as the four-eyes principle say nothing about whether they actually hold up under time pressure. Effectiveness can only be verified through realistic testing, not through process descriptions alone.<\/p>\n<\/div>\n<nav class=\"rc-toc\" aria-label=\"Contents\">\n<div class=\"rc-toc-label\">Contents<\/div>\n<ol>\n<li><a href=\"#a1-why-do-so-few-wire-transfer-cases-cause-\">Why do so few wire transfer cases cause the largest share of losses?<\/a><\/li>\n<li><a href=\"#a2-what-does-social-engineering-have-to-do-\">What does social engineering have to do with DORA&#039;s ICT risk framework?<\/a><\/li>\n<li><a href=\"#a3-why-does-documentation-fail-to-reveal-a-\">Why does documentation fail to reveal a control gap?<\/a><\/li>\n<li><a href=\"#a4-which-specific-control-elements-should-b\">Which specific control elements should be reviewed now?<\/a><\/li>\n<li><a href=\"#a5-what-is-the-next-step-for-ones-own-contr\">What is the next step for one&#039;s own control landscape?<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"rc-figures\">\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"89\">89<span class=\"unit\">EUR million<\/span><\/div>\n<div class=\"rc-figure-label\">Losses from fraudulent wire transfers in Austria in 2025<\/div>\n<div class=\"rc-figure-src\">Oesterreichische Nationalbank, cited by Meinbezirk.at<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"83\">83<span class=\"unit\">%<\/span><\/div>\n<div class=\"rc-figure-label\">Share of wire transfer losses attributable to social engineering<\/div>\n<div class=\"rc-figure-src\">Oesterreichische Nationalbank, cited by Meinbezirk.at<\/div>\n<\/div>\n<div class=\"rc-figure-cell\">\n<div class=\"rc-figure-value\" data-to=\"3.000\">3,000<span class=\"unit\">EUR<\/span><\/div>\n<div class=\"rc-figure-label\">Average loss per fraudulent wire transfer in 2025<\/div>\n<div class=\"rc-figure-src\">Oesterreichische Nationalbank, cited by Leadersnet.at<\/div>\n<\/div>\n<\/div>\n<h2 id=\"a1-why-do-so-few-wire-transfer-cases-cause-\">Why do so few wire transfer cases cause the largest share of losses?<\/h2>\n<p>Because the average loss per fraudulent wire transfer, at around EUR 3,000, far exceeds that of a card payment, and in individual cases exceeds one million euros.<\/p>\n<p>According to the Oesterreichische Nationalbank, nine out of ten fraud cases involved card payments, with an average loss of around EUR 75 per case. For wire transfers, the average was around EUR 3,000, and in individual cases exceeded one million euros. Measured by transaction volume, Austria&#8217;s fraud rate for wire transfers, at 0.004 percent, is twice the EU average.<\/p>\n<p>This distribution follows a pattern that is underrepresented in many risk registers: high frequency with low individual loss versus low frequency with high individual loss. Control catalogues calibrated primarily on case numbers tend to underestimate the second pattern, even though it accounts for the larger share of total losses.<\/p>\n<h2 id=\"a2-what-does-social-engineering-have-to-do-\">What does social engineering have to do with DORA&#039;s ICT risk framework?<\/h2>\n<p>DORA requires an independent ICT risk control function, but this function primarily oversees technical and procedural controls, not the moment at which an authorised person releases a payment themselves.<\/p>\n<p>Under Article 6(4) of the DORA regulation, financial entities must ensure an appropriate level of independence for their ICT risk control function, implemented through a separation of risk management, control and audit functions following the three-lines-of-defence model, as explained by the Austrian Financial Market Authority (FMA).<\/p>\n<p>Social engineering undermines this structure without formally breaching it: the person who releases the payment acts within their authority, deceived by a fabricated sense of urgency. As described in &#8216;ISMS: People, Processes and Technology are Decisive&#8217;, a technical control is only as effective as the behaviour of the person operating it in a real incident.<\/p>\n<h2 id=\"a3-why-does-documentation-fail-to-reveal-a-\">Why does documentation fail to reveal a control gap?<\/h2>\n<p>Because a documented four-eyes principle looks complete in every audit file, but says nothing about whether it is actually observed under time pressure and a perceived sense of urgency.<\/p>\n<p>A control register confirms the existence of a process step, not its effect in a concrete attack scenario. As the article &#8216;Risk Management Serves the Achievement of Objectives, Not Itself&#8217; points out, a system fails its purpose when it looks complete on paper but has never been tested operationally under real conditions.<\/p>\n<p>Only a targeted review shows whether a callback requirement for changed account details is actually observed, or whether exception approvals under time pressure quietly become the rule. This exact difference between documented and lived control often goes undetected in a standard audit.<\/p>\n<h2 id=\"a4-which-specific-control-elements-should-b\">Which specific control elements should be reviewed now?<\/h2>\n<p>Three elements are most likely to show, in a real incident, whether the release chain holds: the callback channel, the threshold logic and the escalation path.<\/p>\n<p>These three elements can be reviewed individually and therefore provide more reliable statements than a pure process description.<\/p>\n<ul>\n<li>Callback requirement: Is there an obligation to verify changed payment details through a second, independent channel, and is this obligation checked on a sample basis?<\/li>\n<li>Thresholds: Are wire transfers above a defined amount manually cross-checked, regardless of time of day or a fabricated sense of urgency?<\/li>\n<li>Escalation: Can employees stop a payment without this being treated as a breach of trust towards an apparent superior?<\/li>\n<\/ul>\n<h2 id=\"a5-what-is-the-next-step-for-ones-own-contr\">What is the next step for one&#039;s own control landscape?<\/h2>\n<p>Internal audit should carry out a simulated social engineering test case for payment release in the next audit cycle, rather than limiting itself to confirming process documentation.<\/p>\n<p>The idea behind &#8216;FINMA Supervisory Communication 05\/2025 as a Wake-up Call for Resilience by Design&#8217;, building resilience into processes from the outset rather than reviewing it afterwards, applies directly to payment releases.<\/p>\n<p>A concrete first step is a simulated CEO fraud test case in the next ICS review round, jointly owned by internal audit and the payments team, evaluating actual response times and escalation paths rather than just the process documentation.<\/p>\n<aside class=\"rc-takeaways\">\n<div class=\"rc-takeaways-label\">For practice<\/div>\n<h2>Key points<\/h2>\n<ul>\n<li>A few cases with high individual losses cause the largest share of total wire transfer fraud losses, not the mass of small fraud cases.<\/li>\n<li>A documented ICT risk control function under DORA only covers social engineering if processes such as callbacks and escalation are regularly tested under realistic conditions.<\/li>\n<li>Internal audit should include effectiveness tests for payment releases, rather than pure documentation reviews, in the next audit cycle.<\/li>\n<li>Thresholds and callback requirements are only as robust as their actual enforcement under time pressure.<\/li>\n<\/ul>\n<\/aside>\n<section class=\"rc-faq\">\n<div class=\"rc-faq-head\">\n<div class=\"rc-faq-label\">FAQ<\/div>\n<h2>Frequently asked questions<\/h2>\n<\/div>\n<div class=\"rc-faq-list\">\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">How high was total payment fraud in Austria in 2025?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The Oesterreichische Nationalbank recorded total losses of EUR 115.4 million for 2025, an increase of 17.6 percent over the previous year. Wire transfers accounted for only nine percent of cases, yet caused around EUR 89 million, or 78 percent of total losses.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What is the difference between the average loss in card fraud and wire transfer fraud?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Card payments accounted for nine out of ten fraud cases, with an average loss of around EUR 75 per case. For wire transfers, the average was around EUR 3,000, and in individual cases exceeded one million euros, which is why a small number of cases cause the largest share of total losses.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Why does a documented four-eyes principle not reliably prevent social engineering?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The person releasing the payment formally acts within their authority but is deceived by a fabricated sense of urgency. A control register only confirms the existence of the process step, not whether it is actually observed under time pressure in a concrete attack scenario.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">What role should internal audit play in reviewing payment releases?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>Internal audit should carry out a simulated social engineering test case for payment release in the next audit cycle, together with the payments team, evaluating actual response times and escalation paths rather than merely confirming the process documentation.<\/p>\n<\/div>\n<\/details>\n<details class=\"rc-faq-item\">\n<summary><span class=\"rc-faq-frage\">Which three control elements show, in a real incident, whether a release chain holds?<\/span><span class=\"rc-faq-mark\" aria-hidden=\"true\"><\/span><\/summary>\n<div class=\"rc-faq-answer\">\n<p>The decisive elements are the callback requirement for changed payment details via a second channel, the threshold logic for manual cross-checking above a defined amount, and an escalation path that allows employees to stop a payment without a breach of trust.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<\/section>\n<section class=\"rc-sources\">\n<div class=\"rc-sources-label\">Sources<\/div>\n<ol>\n<li><a href=\"https:\/\/www.fma.gv.at\/querschnittsthemen\/dora\/dora-ikt-risiko-management\/\" target=\"_blank\" rel=\"noopener nofollow\">DORA &#8211; ICT Risk Management<\/a><span class=\"rc-source-pub\">Austrian Financial Market Authority (FMA)<\/span><\/li>\n<li><a href=\"https:\/\/www.meinbezirk.at\/c-wirtschaft\/zahlungsbetrug-verursachte-im-vorjahr-115-millionen-euro-schaden_a8857823\" target=\"_blank\" rel=\"noopener nofollow\">OeNB Report: Payment Fraud Caused EUR 115 Million in Losses Last Year<\/a><span class=\"rc-source-pub\">MeinBezirk.at<\/span><\/li>\n<\/ol>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A recent fraud report shows that social engineering attacks on wire transfers are rare but especially costly. The lesson for the control landscape: documented controls such as the four-eyes principle say nothing about whether they actually hold up under time pressure. Effectiveness can only be verified through realistic testing, not through process descriptions alone.<\/p>\n","protected":false},"author":5,"featured_media":70152,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Besfort Kuqi","real_author_title":"Founder & CEO","real_author_bio":"Views the GRC market as someone who built the platform from an idea into a company with entities across Europe, MEA and APAC. This shapes his writing on growth, industry dynamics and what it takes to build and scale a GRC software company.","real_author_photo":53573,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[30],"tags":[114,115,111,112,113],"class_list":["post-70151","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-news","tag-ceo-fraud-test-case","tag-payment-fraud-2025","tag-social-engineering-wire-transfer-fraud","tag-dora-ict-risk-control-function","tag-four-eyes-principle-effectiveness"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"superadmin\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Social Engineering: Why ICT Risk Controls Fail\" \/>\n\t\t<meta property=\"og:description\" content=\"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/89-million-euro-loss-ict-risk-controls-dora-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/89-million-euro-loss-ict-risk-controls-dora-swissgrc.webp\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-08-21T17:15:53+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-17T12:55:41+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Social Engineering: Why ICT Risk Controls Fail\" \/>\n\t\t<meta name=\"twitter:description\" content=\"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/Bes_klein_-10.png\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"superadmin\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#blogposting\",\"name\":\"Social Engineering: Why ICT Risk Controls Fail\",\"headline\":\"EUR 89 Million in Losses: What ICT Risk Controls Miss\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/08\\\/89-million-euro-loss-ict-risk-controls-dora-swissgrc.webp\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract distribution curve graphic in magenta, category Regulation & Supervision\"},\"datePublished\":\"2026-08-21T19:15:53+02:00\",\"dateModified\":\"2026-09-17T14:55:41+02:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#webpage\"},\"articleSection\":\"Industry News, CEO fraud test case, payment fraud 2025, social engineering wire transfer fraud, DORA ICT risk control function, four-eyes principle effectiveness\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/industry-news\\\/#listItem\",\"name\":\"Industry News\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/industry-news\\\/#listItem\",\"position\":2,\"name\":\"Industry News\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/industry-news\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#listItem\",\"name\":\"EUR 89 Million in Losses: What ICT Risk Controls Miss\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#listItem\",\"position\":3,\"name\":\"EUR 89 Million in Losses: What ICT Risk Controls Miss\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/category\\\/industry-news\\\/#listItem\",\"name\":\"Industry News\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/\",\"name\":\"superadmin\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#authorImage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/01\\\/logo-red.svg\",\"width\":96,\"height\":96,\"caption\":\"superadmin\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/\",\"name\":\"Social Engineering: Why ICT Risk Controls Fail\",\"description\":\"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/author\\\/superadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2026\\\/08\\\/89-million-euro-loss-ict-risk-controls-dora-swissgrc.webp\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Swiss GRC article image showing the logo and an abstract distribution curve graphic in magenta, category Regulation & Supervision\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/89-million-euro-loss-ict-risk-controls-dora\\\/#mainImage\"},\"datePublished\":\"2026-08-21T19:15:53+02:00\",\"dateModified\":\"2026-09-17T14:55:41+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Social Engineering: Why ICT Risk Controls Fail<\/title>\n\n","aioseo_head_json":{"title":"Social Engineering: Why ICT Risk Controls Fail","description":"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.","canonical_url":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#blogposting","name":"Social Engineering: Why ICT Risk Controls Fail","headline":"EUR 89 Million in Losses: What ICT Risk Controls Miss","author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/89-million-euro-loss-ict-risk-controls-dora-swissgrc.webp","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract distribution curve graphic in magenta, category Regulation & Supervision"},"datePublished":"2026-08-21T19:15:53+02:00","dateModified":"2026-09-17T14:55:41+02:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#webpage"},"articleSection":"Industry News, CEO fraud test case, payment fraud 2025, social engineering wire transfer fraud, DORA ICT risk control function, four-eyes principle effectiveness"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/industry-news\/#listItem","name":"Industry News"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/industry-news\/#listItem","position":2,"name":"Industry News","item":"https:\/\/swissgrc.com\/en\/category\/industry-news\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#listItem","name":"EUR 89 Million in Losses: What ICT Risk Controls Miss"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#listItem","position":3,"name":"EUR 89 Million in Losses: What ICT Risk Controls Miss","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/en\/category\/industry-news\/#listItem","name":"Industry News"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/en\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/en\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author","url":"https:\/\/swissgrc.com\/en\/author\/superadmin\/","name":"superadmin","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#authorImage","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/01\/logo-red.svg","width":96,"height":96,"caption":"superadmin"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#webpage","url":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/","name":"Social Engineering: Why ICT Risk Controls Fail","description":"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/swissgrc.com\/en\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/en\/author\/superadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/89-million-euro-loss-ict-risk-controls-dora-swissgrc.webp","@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#mainImage","width":1200,"height":630,"caption":"Swiss GRC article image showing the logo and an abstract distribution curve graphic in magenta, category Regulation & Supervision"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/#mainImage"},"datePublished":"2026-08-21T19:15:53+02:00","dateModified":"2026-09-17T14:55:41+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/en\/#website","url":"https:\/\/swissgrc.com\/en\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"en-GB","publisher":{"@id":"https:\/\/swissgrc.com\/en\/#organization"}}]},"og:locale":"en_GB","og:site_name":"Swiss GRC | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"Social Engineering: Why ICT Risk Controls Fail","og:description":"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.","og:url":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/","og:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/89-million-euro-loss-ict-risk-controls-dora-swissgrc.webp","og:image:secure_url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/89-million-euro-loss-ict-risk-controls-dora-swissgrc.webp","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-08-21T17:15:53+00:00","article:modified_time":"2026-09-17T12:55:41+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"Social Engineering: Why ICT Risk Controls Fail","twitter:description":"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2026\/08\/Bes_klein_-10.png","twitter:label1":"Written by","twitter:data1":"superadmin","twitter:label2":"Est. reading time","twitter:data2":"6 minutes"},"aioseo_meta_data":{"post_id":"70151","title":"Social Engineering: Why ICT Risk Controls Fail","description":"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.","keywords":null,"keyphrases":{"focus":{"keyphrase":"ICT risk controls","score":0,"analysis":[]},"additional":[{"keyphrase":"social engineering wire transfer fraud","score":0,"analysis":[]},{"keyphrase":"DORA ICT risk control function","score":0,"analysis":[]},{"keyphrase":"four-eyes principle effectiveness","score":0,"analysis":[]},{"keyphrase":"CEO fraud test case","score":0,"analysis":[]},{"keyphrase":"payment fraud 2025","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"Social Engineering: Why ICT Risk Controls Fail","og_description":"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.","og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"Social Engineering: Why ICT Risk Controls Fail","twitter_description":"EUR 89 million in losses from social engineering: this article explains why ICT risk controls under DORA need real tests, not just documentation.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-09-17 12:56:48","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-08-21 19:15:53","updated":"2026-09-17 13:11:42","focus_keyword":"ICT risk controls","additional_keywords":[{"word":"social engineering wire transfer fraud","score":63,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":6},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"DORA ICT risk control function","score":72,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":6},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"four-eyes principle effectiveness","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"CEO fraud test case","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"payment fraud 2025","score":80,"items":{"introductionKeyword":{"score":9},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}}],"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/en\/category\/industry-news\/\" title=\"Industry News\">Industry News<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tEUR 89 Million in Losses: What ICT Risk Controls Miss\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/en\/"},{"label":"Industry News","link":"https:\/\/swissgrc.com\/en\/category\/industry-news\/"},{"label":"EUR 89 Million in Losses: What ICT Risk Controls Miss","link":"https:\/\/swissgrc.com\/en\/89-million-euro-loss-ict-risk-controls-dora\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/comments?post=70151"}],"version-history":[{"count":4,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70151\/revisions"}],"predecessor-version":[{"id":70331,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/posts\/70151\/revisions\/70331"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media\/70152"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/media?parent=70151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/categories?post=70151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/en\/wp-json\/wp\/v2\/tags?post=70151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}