1. CFO is using Gmail without 2-factor authentication 2. CFO enters his Google credentials on a random website 3. CEO takes CFO e-mail as valid without checki

1. CFO is using Gmail without 2-factor authentication 2. CFO enters his Google credentials on a random website 3. CEO takes CFO e-mail as valid without checking for the existence and verifying a PGP signature 4. CEO sends Bitcoin for an existing customer to a new address he got by e-mail rather than to the established one On the positive side, the CEO eventually sought confirmation from the customer.