For several years, I worked at a fairly large company as the CTO. All C-level executives (and some managers) had G-suite accounts, and all executive meetings or calls were to be on the shared calendar, allowing anyone to enter any call without prior request. Of course, as in all companies, people would leave the company (by personal choice or the company's decision) and new people would join. Often, people would forget and add random things to the calendar (like picking up a son from school, dentist appointments, etc.).

Our CFO left our company to work at a large investment fund. As usual, I would have removed her from our Gsuite, but the C-levels wanted to keep the email so we could still access her contacts and "impersonate" her in ongoing deals. She created a new password, sent it to us, and stopped using the account.

However, two years passed and some calendar events started to appear. They were from an unknown user but with the old CFO's email, involving random professional meetings with random people. We called her, and she said that she didn't have the account credentials or even the cellphone she previously used.

So we did what most companies do: We ignored it.

Fast forward a few months, our head of marketing was at a startup event with investors when a guy he didn't know introduced himself. He was from another company in the same market as ours and was concerned that he had started negotiating to buy an IP from us but we stopped responding. We had never sold any IP, so my coworker asked with whom he had been talking. Of course, it was with the impersonator. When we checked the email, there weren’t any recent emails sent or received. Weird.

A few days later, we called him to the office, offered him some coffee, and he showed us the conversation. It contained a lot of internal details, a full 9-page PDF with specifications and valuation, pricing, and payment details, with the payment destination being our company's account!

It didn't make any sense. It wasn’t just an error. It wasn’t just a scam. Why would the person direct the money to us?

We tried to investigate, but with many things on our plate, the mystery was again sidelined.

A few weeks later, we had a large sales event inland. By local legislation, all events of a certain size must have a paramedic present. We hired a recent college graduate for this role. She reported some sexual harassment from the construction workers we had hired to build the stage and event structure. As we were investigating this and talking with the authorities, we noticed some calendar events between the medic and the impersonator. Our CEO joined one of these meetings, with me beside him at his desk. Neither party turned on their camera. The impersonator's voice, calm and professional, stated that since our CEO had joined the meeting, he could leave the rest to him and then exited the meeting. We talked to the medic; the impersonator had offered her the equivalent of 20k dollars to not make any public claims about the harassment. We had never discussed any of this during our board meetings.

We started to panic. What else could the impersonator have done? How long had he been posing as us?

We contacted a security company to investigate. They deployed four agents who began to analyze data, track everyone, call people for interrogation, and so on.

In a couple of days, they identified a 23-year-old guy from accounting as the impersonator. We called him into a meeting with all directors. He was visibly nervous but explained his story. A few months before joining the company, he had bought a used cellphone online, on an eBay-like website. This cellphone had belonged to the former CFO, who hadn't wiped it before selling. He began reading the saved emails and documents and got excited about the company's strategy, then applied and got the job. He even shared this story with his recruiter (as in "look at God's will"), but nobody reported it to us, as it seemed irrelevant.

So, he occasionally received emails and acted on them, with the best intentions. He actually had the authority to send and receive money, since he worked in the accounting department. He said that initially, he would ask for advice on what to do, but never received any good suggestions, so he stopped asking. From the first CFO to him, we had two other CFOs. Apparently, during this time, we also had a shadow one. He solved many issues, from workers asking for money to renegotiating payment deadlines. He was actually very good at it.

He showed us all the emails and deals he made, and everything was, in fact, recorded in our system, with invoices sent and everything.

The directors debated whether what he had done was good, bad, illegal, and whether he should receive a reward

, etc.

We voted and then promoted him to a position akin to vice-CFO and gave him a substantial bonus, considering all the legal expenses he saved us.

I left the company a few months after that, but I heard he went on to work at a 'cool' startup, I think Notion or Spotify, something like that.

He was a very intelligent and humble guy, and we met him just because of a series of coincidences with a calendar app.