Cyber Sting Reveals Corporate Vulnerabilities to BEC Scams

The DOJ Recently Enacted a Crackdown on BEC Scams, Netting 74 Arrests

The Department of Justice (DOJ) recently announced a global cyber sting operation that netted 74 arrests. The crackdown specifically targeted Business Email Compromise (BEC) scams, which pose a growing threat to businesses of all sizes. A BEC is when a hacker gains access to a corporate email account and spoofs the owner’s identity to defraud the company or its employees, customers, or partners of money, etc.

According to a press statement by the DOJ, “Operation Wire Wire” involved a coordinated law enforcement effort with the U.S. Department of Homeland Security, U.S. Department of the Treasury, and the U.S. Postal Inspection Service. The operation, which was conducted over a six-month period, resulted in the seizure of nearly $2.4 million, and the disruption and recovery of approximately $14 million in fraudulent wire transfers.

In one case, the defendant gained access to email accounts belonging to a Massachusetts real estate attorney and sent emails to recipients that “spoofed” the real estate attorney’s account in an attempt to cause the email recipient to transfer nearly $500,000, which was intended to be used for payment in connection with a real estate transaction, to a shell account controlled by the defendant. Another case involved 23 individuals charged in the Southern District of Florida with laundering at least $10 million from proceeds of BEC scams, including approximately $1.4 million from a victim corporation in Seattle, as well as various title companies and a law firm.

The Hallmarks of a BEC Scam

BEC scams often target businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments. They also seek out businesses or law firms involved in large deals or real estate transactions. The perpetrators compromise legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds.

There are several versions of the BEC fraud. In one common scam, a business, which often has a long-standing relationship with a supplier, is asked to wire funds for invoice payment to an alternate, fraudulent account. Another scam involves hacking into the e-mail accounts of high-level business executives and using the compromised account to send a wire transfer request to a second employee within the company who is normally responsible for processing these requests or directly to the financial institution.

BEC scams can take a variety of other forms. For instance, they may involve fraudulent requests for checks rather than wire transfers, and they may target sensitive information such as personally identifiable information (PII) or employee tax records instead of, or in addition to, money. In addition, they do not always involve an actual “compromise” of an email account or computer network. 

Because BEC scams are often fairly sophisticated, they can be difficult to detect. Perpetrators often monitor and gather information about their victims for several months prior to launching an attack. Accordingly, the e-mail requests for a wire transfer are well written and specific to the business being victimized. In addition, the dollar amounts requested are similar to normal business transaction amounts in an effort to avoid suspicion.

How to Prevent Falling Victim to a BEC Scam

Business email compromise scams can significantly hurt your bottom-line by not only causing financial losses, but also by harming your business relationships with clients and vendors. Given the risks, here are several tips for safeguarding your company against these attacks:

• Avoid using free, web-based e-mail accounts to conduct business.
• Beware of what your business posts to social media and company websites, especially job duties/descriptions, hierarchal information, and out of office details.
• Train employees not open e-mail from unknown senders, click on links in the e-mail, or open attachments.
• Do not use the “Reply” option to respond to any business e-mails. Instead, use the “Forward” option and either type in the correct e-mail address or select it from the e-mail address book to ensure the intended recipient’s correct e-mail address is used.
• Implement comprehensive policies regarding wire transfer requests that specifically address how to handle requests to change a wire recipient’s account information, requests to add a new recipient, or requests that take place outside of the normal channels.
• Create intrusion detection system rules that flag e-mails with extensions that are similar to company e-mail. For example, legitimate e-mail of com would flag fraudulent e-mail of abc-company.com.
• Register all company domains that are slightly different than the actual company domain.
• Verify changes in vendor payment location by adding additional two-factor authentication such as having a secondary sign- off by company personnel.
• Confirm requests for transfers of funds. When using phone verification as part of the two-factor authentication, use previously known numbers, not the numbers provided in the e-mail request.
• Know the habits of your customers, including the details of, reasons behind, and amount of payments.
• Carefully scrutinize all e-mail requests for transfer of funds to determine if the requests are out of the ordinary.

For businesses, it can be difficult to keep track of the increasing number of cyber threats. As they say in sports, the best defense is a good offense. That means making it as difficult as possible for cyber criminals to target your business and being ready to respond should you still fall victim to an attack.

Do you have any feedback, thoughts, reactions or comments concerning this topic? Feel free to leave a comment below for Fernando M. Pinguelo. If you have any questions about this post, please contact me or the Scarinci Hollenbeck attorney with whom you work. To learn more about data privacy and security, visit eWhiteHouse Watch – Where Technology, Politics, and Privacy Collide (http://ewhwblog.com).