Could Your Staff Spot an Email Scam?

Could Your Staff Spot an Email Scam?

If your staff members aren’t properly trained to spot an email scam, your company could lose millions of dollars. According to the FBI’s Internet Crime Complaint Center 2018 Internet Crime Report, business email compromise (BEC) scams and payroll diversion schemes resulted in $1.3 billion in losses in 2018.

Some of the scams happened close to home. In August 2018, the FBI’s Internet Crime Complaint Center (IC3) received a complaint filed on behalf of a town located in New Jersey. The town was the victim of a BEC scam in which they transferred over $1M to a fraudulent account. Thankfully, the FBI was able to work with financial institution partners to successfully freeze the funds and return the money to the town. Of course, many victims of cyber-attacks are not so lucky.

2018 Internet Crime Report

The 2018 Internet Crime Report confirmed that online fraud continues to be extremely profitable for cybercriminals, at the expense of individuals and organizations across the country. Overall, IC3 received 351,937 complaints in 2018, which represent a slight increase over the 301,580 complaints received in 2017. IC3 also estimated that cyber-criminals were responsible for a total of $2.7 billion in financial losses, which is nearly double the $1.4 billion reported in the prior year.

“The 2018 report shows how prevalent these crimes are,” Donna Gregory, chief of IC3, wrote in a statement. “It also shows that the financial toll is substantial and a victim can be anyone who uses a connected device.”

Business Email Compromise

BEC scams remain among the most common and most common cyber-crimes. In 2018, the IC3 received 20,373 BEC/E-mail Account Compromise (EAC) complaints with adjusted losses of over $1.2 billion.

BEC/EAC is a sophisticated scam targeting both businesses and individuals performing wire transfer payments. In one common scam, a business, which often has a long-standing relationship with a supplier, is asked to wire funds for invoice payment to an alternate, fraudulent account. Another scam involves hacking into the e-mail accounts of high-level business executives and using the compromised account to send a wire transfer request to a second employee within the company who is normally responsible for processing these requests or directly to the financial institution.

The perpetrators of a BEC scam are fairly sophisticated and, therefore, more difficult to detect. The e-mail requests for a wire transfer are well written and specific to the business being victimized. In addition, the dollar amounts requested are similar to normal business transaction amounts.

Prior to initiating the fraud, the perpetrators monitor their selected victims to determine the individuals and protocol necessary to perform wire transfers within a specific business environment. They may also send “phishing” e-mails to obtain additional details regarding business or individuals being targeted (name, travel dates, etc.).

BEC and EAC scams are constantly evolving as scammers become more sophisticated. In 2013, BEC/EAC scams routinely began with the hacking or spoofing of the email accounts of chief executive officers or chief financial officers, and fraudulent emails were sent requesting wire payments be sent to fraudulent locations. The schemes are increasingly diverse, involving personal emails compromised, vendor emails compromised, spoofed lawyer email accounts, and requests for W-2 information. While all industries are vulnerable to BEC and EAC attacks, they are particularly common in the real estate sector.

Payroll Diversion

Payroll diversion is another costly Internet-related fraud that increasingly targets businesses. In 2018, the scam resulted in a combined reported loss of $100M, with only 100 complaints reported to IC3.

In the Payroll Diversion scam, cybercriminals target employees through phishing emails designed to capture an employee’s login credentials. Once the cybercriminal has obtained an employee’s credentials, the credentials are used to access the employee’s payroll account. The cybercriminal will typically add rules to the employee’s account preventing the employee from receiving alerts regarding direct deposit changes. The cybercriminal will then change the direct deposit information, redirecting the payroll funds to an account controlled by the cybercriminal, which is often a prepaid card. Institutions most affected by this scam have been education, healthcare, and commercial airway transportation.

Safeguards Businesses Should Adopt

The BEC and payroll scams can not only cause financial losses but also significantly harm business relations. With this in mind, below are several tips to help avoid falling victim:

• Avoid using free, web-based e-mail accounts to conduct business.
• Beware of what your business posts to social media and company websites, especially job duties/descriptions, hierarchal information, and out of office details.
• Train employees to not open e-mails from unknown senders, click on links in the e-mail, or open attachments.
• Do not use the “Reply” option to respond to any business e-mails. Instead, use the “Forward” option and either type in the correct e-mail address or select it from the e-mail address book to ensure the intended recipient’s correct e-mail address is used.
• Implement comprehensive policies regarding wire transfer requests that specifically address how to handle requests to change a wire recipient’s account information, requests to add a new recipient or requests that take place outside of the normal channels.
• Create intrusion detection system rules that flag e-mails with extensions that are similar to company e-mail. For example, legitimate e-mail of abc_company.com would flag fraudulent e-mail of abc-company.com.
• Register all company domains that are slightly different than the actual company domain.
• Verify changes in vendor payment location by adding additional two-factor authentication such as having a secondary sign-off by company personnel.
• Confirm requests for transfers of funds. When using phone verification as part of the two-factor authentication, use previously known numbers, not the numbers provided in the e-mail request.
• Know the habits of your customers, including the details of, reasons behind, and amount of payments.

For businesses, it can be challenging to keep track of the increasing number of cyber threats. However, it is imperative to be proactive. That includes making it as difficult as possible for cyber criminals to target your business and being ready to respond should you still fall victim to an attack.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, Robert E. Levy, or the Scarinci Hollenbeck attorney with whom you work, at 201-806-3364.