Attackers stole fuel card sign-in code from office voicemail, spent £23K

An intruder signed into a transport company's fuel card portal by choosing phone-call delivery of the second-factor code to the office landline. The code was recorded on voicemail protected by a default PIN, after which 31 replacement cards were ordered and about £23,000 of diesel was charged over four days.

• The two-factor code was recorded on the office landline's voicemail
• The mailbox PIN was never changed from the default last four digits of the extension
• 31 cards were ordered and about £23,000 of diesel was spent in four days
• The company disabled remote voicemail access and moved to authenticator apps