Scarinci Hollenbeck, LLC
The Firm
201-896-4100 info@sh-law.comAuthor: Scarinci Hollenbeck, LLC|July 5, 2018
The Department of Justice (DOJ) recently announced a global cyber sting operation that netted 74 arrests. The crackdown specifically targeted Business Email Compromise (BEC) scams, which pose a growing threat to businesses of all sizes. A BEC is when a hacker gains access to a corporate email account and spoofs the owner’s identity to defraud the company or its employees, customers, or partners of money, etc.
According to a press statement by the DOJ, “Operation Wire Wire” involved a coordinated law enforcement effort with the U.S. Department of Homeland Security, U.S. Department of the Treasury, and the U.S. Postal Inspection Service. The operation, which was conducted over a six-month period, resulted in the seizure of nearly $2.4 million, and the disruption and recovery of approximately $14 million in fraudulent wire transfers.
In one case, the defendant gained access to email accounts belonging to a Massachusetts real estate attorney and sent emails to recipients that “spoofed” the real estate attorney’s account in an attempt to cause the email recipient to transfer nearly $500,000, which was intended to be used for payment in connection with a real estate transaction, to a shell account controlled by the defendant. Another case involved 23 individuals charged in the Southern District of Florida with laundering at least $10 million from proceeds of BEC scams, including approximately $1.4 million from a victim corporation in Seattle, as well as various title companies and a law firm.
BEC scams often target businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments. They also seek out businesses or law firms involved in large deals or real estate transactions. The perpetrators compromise legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds.
There are several versions of the BEC fraud. In one common scam, a business, which often has a long-standing relationship with a supplier, is asked to wire funds for invoice payment to an alternate, fraudulent account. Another scam involves hacking into the e-mail accounts of high-level business executives and using the compromised account to send a wire transfer request to a second employee within the company who is normally responsible for processing these requests or directly to the financial institution.
BEC scams can take a variety of other forms. For instance, they may involve fraudulent requests for checks rather than wire transfers, and they may target sensitive information such as personally identifiable information (PII) or employee tax records instead of, or in addition to, money. In addition, they do not always involve an actual “compromise” of an email account or computer network.
Because BEC scams are often fairly sophisticated, they can be difficult to detect. Perpetrators often monitor and gather information about their victims for several months prior to launching an attack. Accordingly, the e-mail requests for a wire transfer are well written and specific to the business being victimized. In addition, the dollar amounts requested are similar to normal business transaction amounts in an effort to avoid suspicion.
Business email compromise scams can significantly hurt your bottom-line by not only causing financial losses, but also by harming your business relationships with clients and vendors. Given the risks, here are several tips for safeguarding your company against these attacks:
For businesses, it can be difficult to keep track of the increasing number of cyber threats. As they say in sports, the best defense is a good offense. That means making it as difficult as possible for cyber criminals to target your business and being ready to respond should you still fall victim to an attack.
Do you have any feedback, thoughts, reactions or comments concerning this topic? Feel free to leave a comment below for Fernando M. Pinguelo. If you have any questions about this post, please contact me or the Scarinci Hollenbeck attorney with whom you work. To learn more about data privacy and security, visit eWhiteHouse Watch – Where Technology, Politics, and Privacy Collide (http://ewhwblog.com).
The Firm
201-896-4100 info@sh-law.comThe Department of Justice (DOJ) recently announced a global cyber sting operation that netted 74 arrests. The crackdown specifically targeted Business Email Compromise (BEC) scams, which pose a growing threat to businesses of all sizes. A BEC is when a hacker gains access to a corporate email account and spoofs the owner’s identity to defraud the company or its employees, customers, or partners of money, etc.
According to a press statement by the DOJ, “Operation Wire Wire” involved a coordinated law enforcement effort with the U.S. Department of Homeland Security, U.S. Department of the Treasury, and the U.S. Postal Inspection Service. The operation, which was conducted over a six-month period, resulted in the seizure of nearly $2.4 million, and the disruption and recovery of approximately $14 million in fraudulent wire transfers.
In one case, the defendant gained access to email accounts belonging to a Massachusetts real estate attorney and sent emails to recipients that “spoofed” the real estate attorney’s account in an attempt to cause the email recipient to transfer nearly $500,000, which was intended to be used for payment in connection with a real estate transaction, to a shell account controlled by the defendant. Another case involved 23 individuals charged in the Southern District of Florida with laundering at least $10 million from proceeds of BEC scams, including approximately $1.4 million from a victim corporation in Seattle, as well as various title companies and a law firm.
BEC scams often target businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments. They also seek out businesses or law firms involved in large deals or real estate transactions. The perpetrators compromise legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds.
There are several versions of the BEC fraud. In one common scam, a business, which often has a long-standing relationship with a supplier, is asked to wire funds for invoice payment to an alternate, fraudulent account. Another scam involves hacking into the e-mail accounts of high-level business executives and using the compromised account to send a wire transfer request to a second employee within the company who is normally responsible for processing these requests or directly to the financial institution.
BEC scams can take a variety of other forms. For instance, they may involve fraudulent requests for checks rather than wire transfers, and they may target sensitive information such as personally identifiable information (PII) or employee tax records instead of, or in addition to, money. In addition, they do not always involve an actual “compromise” of an email account or computer network.
Because BEC scams are often fairly sophisticated, they can be difficult to detect. Perpetrators often monitor and gather information about their victims for several months prior to launching an attack. Accordingly, the e-mail requests for a wire transfer are well written and specific to the business being victimized. In addition, the dollar amounts requested are similar to normal business transaction amounts in an effort to avoid suspicion.
Business email compromise scams can significantly hurt your bottom-line by not only causing financial losses, but also by harming your business relationships with clients and vendors. Given the risks, here are several tips for safeguarding your company against these attacks:
For businesses, it can be difficult to keep track of the increasing number of cyber threats. As they say in sports, the best defense is a good offense. That means making it as difficult as possible for cyber criminals to target your business and being ready to respond should you still fall victim to an attack.
Do you have any feedback, thoughts, reactions or comments concerning this topic? Feel free to leave a comment below for Fernando M. Pinguelo. If you have any questions about this post, please contact me or the Scarinci Hollenbeck attorney with whom you work. To learn more about data privacy and security, visit eWhiteHouse Watch – Where Technology, Politics, and Privacy Collide (http://ewhwblog.com).
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.