CyberAuditX
PHISHING AWARENESS & SIMULATION
Request a Consultation
Phishing Awareness

Barbara Corcoran Lost $388,700 to Phishing: The Danger of a 1-Letter Domain Typo

In 2020, Shark Tank investor Barbara Corcoran was tricked out of $388,700 when her bookkeeper received a fake renovation invoice from a domain that differed by just one letter.

6 min read

A Costly Typo on Park Avenue

In February 2020, celebrated real estate entrepreneur and Shark Tank investor Barbara Corcoran publicly announced that she had been defrauded of $388,700 USD.

The incident resonated widely because Corcoran is an exceptionally savvy businesswoman with decades of commercial experience. The attack did not involve complex malware or brute-force hacking — it relied on a single-character typo in an email address.

Key Incident Metric: $388,700 stolen via a lookalike domain. Over 71% of spear-phishing attacks employ typosquatting or visually deceptive domain homoglyphs.

Anatomy of the Wire Fraud

The scam followed a classic Vendor Email Compromise (VEC) pattern:

  1. The Typosquatted Domain: Attackers registered an email domain almost identical to the genuine domain used by Corcoran's executive assistant, differing by a single subtle letter that is easily missed during quick reading on a smartphone.
  2. The Fake Renovation Invoice: Posing as the assistant, the attackers sent an email to Corcoran's bookkeeper with an attached invoice for $388,700, describing it as a payment for a real estate renovation project in Germany.
  3. Plausible Context: Because Corcoran actively invests in global real estate, the invoice appeared contextually plausible to the bookkeeper.
  4. Approval and Execution: The bookkeeper replied to confirm approval, which went straight to the fraudster. The wire was transmitted to a designated German bank account.

The scam was only uncovered when the bookkeeper CC'd the assistant's genuine email address while sending the wire confirmation wire slip, prompting the assistant to ask: "What wire is this?"

The Dramatic Recovery

Unlike the vast majority of wire fraud victims, Corcoran was extraordinarily fortunate. Because the fraudulent wire was flagged within hours:

  • Her team contacted the bank's fraud department immediately.
  • The receiving German bank was notified before the wire cleared into secondary routing accounts.
  • The funds were frozen and eventually returned.

Had the discrepancy been discovered 48 hours later, the money would have been permanently dispersed across international jurisdictions.

Crucial Lessons for Business Leaders

  • Mobile Email Readability Risks: When reading emails on mobile devices, client interfaces frequently collapse or hide the full sender address, displaying only the display name (e.g., "Executive Assistant").
  • Never Trust Email for Wire Instructions: Any email requesting a wire transfer, bank change, or high-value disbursement must be confirmed via a second, non-email channel.
  • Implement Domain-Monitoring & DMARC: Configure DNS with strict SPF, DKIM, and DMARC reject policies, and monitor lookalike domain registrations targeting your brand.