Key Takeaways

  • Orion S.A. (NYSE:OEC) booked a $59.3 million charge in 2024 after an employee was tricked into wiring funds to criminals, equal to about 58% of that year’s operating income.
  • Business email compromise cost U.S. victims $3.05 billion in 2025, according to the FBI, and cloned voices and deepfake video now let the same scam arrive as a live call from the “CFO.”
  • Insurance for social engineering losses is often capped at $250,000 or less, so a large impersonation loss can land almost entirely on shareholders.

On Saturday, Aug. 10, 2024, Orion, a carbon black producer run from Spring, Texas, determined that one of its employees had been manipulated into wiring money to accounts controlled by unknown third parties. No system had been hacked. Two days later the company told the SEC it expected a pre-tax charge of roughly $60 million.

That scheme ran through email. The next one may arrive as a video call with the chief financial officer’s face on screen, and for shareholders the question stays the same: how much of a company’s earnings can one deceived employee send out the door?

What One Scam Did To Orion’s Income Statement

Orion’s 2025 annual report spells out the cost. The company recorded $55.7 million in unrecovered transfers plus $3.6 million in investigation fees, a $59.3 million charge in 2024, when income from operations came to $102.7 million, down from $205.3 million in 2023.

Recovery has been slow. Orion clawed back $9.2 million in 2025, spent another $2.3 million on professional fees, and says it is still pursuing “potentially available insurance coverage.”

Two details matter. Orion excludes the loss from adjusted EBITDA as a non-recurring item, so its $302.2 million adjusted figure for 2024 does not show it. That treatment is common, and it is also how a $59 million loss disappears from the number many analysts screen on. Orion also disclosed the incident under Item 8.01, the “other events” section of Form 8-K, noting that no data or systems were accessed. A loss like this may never appear where investors expect to find cyber incidents.

The fraud is not the only weight on Orion’s stock, which also absorbed an $80.8 million goodwill impairment in 2025 and traded at $5.93 on Sept. 21, a market value of about $335 million. The 2024 charge alone equals nearly 18% of that value.

A Familiar Face Makes The Old Scam Harder To Stop

Business email compromise generated $3.05 billion in reported losses across 24,768 complaints in 2025, up from $2.77 billion in 2024, according to the FBI’s 2025 Internet Crime Report. The attack surface is wider than email. The bureau’s definition of the crime explicitly covers compromising “phone numbers and virtual meeting applications.” The FBI logged 22,364 complaints referencing artificial intelligence, with losses above $893 million.

Video is the newest layer. In early 2024, a Hong Kong finance worker at engineering firm Arup joined a call with what appeared to be the company’s CFO and several colleagues, all of them deepfakes, and made 15 transfers totaling $25.6 million. Arup is private. A listed company would be explaining that on an earnings call.

The exposure is broad. Sixty-two percent of organizations experienced a deepfake attack in the prior 12 months, a Gartner survey of cybersecurity leaders found. The Association for Financial Professionals’ 2026 payments fraud survey found 74% of organizations were affected by business email compromise in 2025.

What stops it? Sometimes one question. In July 2024, an executive at Ferrari N.V. (NYSE:RACE) received WhatsApp messages and a call in a cloned version of CEO Benedetto Vigna’s voice, an attempt Benzinga covered at the time. The executive asked for the title of a book Vigna had recommended days earlier, and the caller hung up, MIT Sloan Management Review recounted.

The Insurance Gap Most Investors Never See

Shareholders often assume a loss like Orion’s is insured. Frequently it is only partly covered. Many standard cyber policies exclude social engineering and fraudulent transfer losses, and where coverage for this kind of fraud exists, it is often subject to sublimits of “$250,000 in total coverage or less.”

Run that against the Arup figure and roughly 99% of a $25.6 million loss sits outside a $250,000 sublimit. The rest is self-insured. Some policies also require employees to confirm banking changes through a separate call or email, and failing that condition “may jeopardize coverage,” the firm notes. In practice, the payment approval process is part of the insurance contract.

Adding AI Tools Without Adding New Openings

Few finance teams have turned AI on the problem. Just 17% of organizations use AI to combat payments fraud, the AFP survey found, although 45% of those users reported better detection of deepfakes. Gartner also found 32% of organizations had faced an attack on AI applications through the application prompt.

Software alone will not close the gap. “You can’t just rely on automated defenses to protect you,” Akif Khan, a senior director at Gartner Research, told Infosecurity Magazine. His fix is procedural: the CFO can call and ask for a transfer, but the payment only goes out once the CFO logs into the finance application, ideally with phishing-resistant multi-factor authentication, and approves it there. Some vendors are starting to build deepfake detection into Teams and Zoom, and Benzinga has examined the deepfake fraud boom as a possible driver for cybersecurity ETFs.

Rolling out a business AI assistant does not retire the verification habits security writers now recommend for video calls, such as a pre-agreed code phrase, a rule that no payment is approved on a call alone, and a callback to a number already on file. Those controls cost little and sit with people, not software.

Speed after the fact matters too. The FBI’s Recovery Asset Team froze $679 million of $1.16 billion in attempted theft across 3,900 incidents in 2025, a 58% success rate.

What To Check In Filings And On Calls

Impersonation losses rarely get a headline. They surface in four places:

  • Non-GAAP add-backs. Line items such as “loss (recovery) due to misappropriation of assets” can sit inside adjusted EBITDA reconciliations, as Orion’s does.
  • Item 8.01 filings. Fraudulently induced transfers may be reported as “other events” rather than as cybersecurity incidents under Item 1.05.
  • Recovery language. “Potentially available” insurance is not booked insurance. Track how much is actually recovered in later quarters.
  • Payment controls. Callback verification and dual approval for wires are fair questions for management on an earnings call.

The Bottom Line

Deepfakes do not create a new kind of loss. They raise the success rate of an old one that cost U.S. victims more than $3 billion in 2025.

The companies most exposed are not necessarily the ones with weak IT. They are the ones that move large wires on short notice through small treasury teams, run by executives whose voices fill hours of public earnings webcasts. Watch the next round of 10-Ks for two things: which companies describe tighter payment approval rules, and which ones quietly add a fraud loss back into adjusted earnings.

Benzinga Disclaimer: This article is from an unpaid external contributor. It does not represent Benzinga’s reporting and has not been edited for content or accuracy.