Scarinci Hollenbeck, LLC, LLCScarinci Hollenbeck, LLC, LLC

Firm Insights

Could Your Staff Spot an Email Scam?

Author: Robert E. Levy

Date: June 4, 2019

Key Contacts

Back

If Your Employees Are Not Properly Trained to Spot an Email Scam, Your Business Could Lose Millions of Dollars…

If your staff members aren’t properly trained to spot an email scam, your company could lose millions of dollars. According to the FBI’s Internet Crime Complaint Center 2018 Internet Crime Report, business email compromise (BEC) scams and payroll diversion schemes resulted in $1.3 billion in losses in 2018.

Could Your Staff Spot an Email Scam ?

Some of the scams happened close to home. In August 2018, the FBI’s Internet Crime Complaint Center (IC3) received a complaint filed on behalf of a town located in New Jersey. The town was the victim of a BEC scam in which they transferred over $1M to a fraudulent account. Thankfully, the FBI was able to work with financial institution partners to successfully freeze the funds and return the money to the town. Of course, many victims of cyber-attacks are not so lucky.

2018 Internet Crime Report

The 2018 Internet Crime Report confirmed that online fraud continues to be extremely profitable for cybercriminals, at the expense of individuals and organizations across the country. Overall, IC3 received 351,937 complaints in 2018, which represent a slight increase over the 301,580 complaints received in 2017. IC3 also estimated that cyber-criminals were responsible for a total of $2.7 billion in financial losses, which is nearly double the $1.4 billion reported in the prior year.

“The 2018 report shows how prevalent these crimes are,” Donna Gregory, chief of IC3, wrote in a statement. “It also shows that the financial toll is substantial and a victim can be anyone who uses a connected device.”

Business Email Compromise

BEC scams remain among the most common and most common cyber-crimes. In 2018, the IC3 received 20,373 BEC/E-mail Account Compromise (EAC) complaints with adjusted losses of over $1.2 billion.

BEC/EAC is a sophisticated scam targeting both businesses and individuals performing wire transfer payments. In one common scam, a business, which often has a long-standing relationship with a supplier, is asked to wire funds for invoice payment to an alternate, fraudulent account. Another scam involves hacking into the e-mail accounts of high-level business executives and using the compromised account to send a wire transfer request to a second employee within the company who is normally responsible for processing these requests or directly to the financial institution.

The perpetrators of a BEC scam are fairly sophisticated and, therefore, more difficult to detect. The e-mail requests for a wire transfer are well written and specific to the business being victimized. In addition, the dollar amounts requested are similar to normal business transaction amounts.

Prior to initiating the fraud, the perpetrators monitor their selected victims to determine the individuals and protocol necessary to perform wire transfers within a specific business environment. They may also send “phishing” e-mails to obtain additional details regarding business or individuals being targeted (name, travel dates, etc.).

BEC and EAC scams are constantly evolving as scammers become more sophisticated. In 2013, BEC/EAC scams routinely began with the hacking or spoofing of the email accounts of chief executive officers or chief financial officers, and fraudulent emails were sent requesting wire payments be sent to fraudulent locations. The schemes are increasingly diverse, involving personal emails compromised, vendor emails compromised, spoofed lawyer email accounts, and requests for W-2 information. While all industries are vulnerable to BEC and EAC attacks, they are particularly common in the real estate sector.

Payroll Diversion

Payroll diversion is another costly Internet-related fraud that increasingly targets businesses. In 2018, the scam resulted in a combined reported loss of $100M, with only 100 complaints reported to IC3.

In the Payroll Diversion scam, cybercriminals target employees through phishing emails designed to capture an employee’s login credentials. Once the cybercriminal has obtained an employee’s credentials, the credentials are used to access the employee’s payroll account. The cybercriminal will typically add rules to the employee’s account preventing the employee from receiving alerts regarding direct deposit changes. The cybercriminal will then change the direct deposit information, redirecting the payroll funds to an account controlled by the cybercriminal, which is often a prepaid card. Institutions most affected by this scam have been education, healthcare, and commercial airway transportation.

Safeguards Businesses Should Adopt

The BEC and payroll scams can not only cause financial losses but also significantly harm business relations. With this in mind, below are several tips to help avoid falling victim:

  • Avoid using free, web-based e-mail accounts to conduct business.
  • Beware of what your business posts to social media and company websites, especially job duties/descriptions, hierarchal information, and out of office details.
  • Train employees to not open e-mails from unknown senders, click on links in the e-mail, or open attachments.
  • Do not use the “Reply” option to respond to any business e-mails. Instead, use the “Forward” option and either type in the correct e-mail address or select it from the e-mail address book to ensure the intended recipient’s correct e-mail address is used.
  • Implement comprehensive policies regarding wire transfer requests that specifically address how to handle requests to change a wire recipient’s account information, requests to add a new recipient or requests that take place outside of the normal channels.
  • Create intrusion detection system rules that flag e-mails with extensions that are similar to company e-mail. For example, legitimate e-mail of abc_company.com would flag fraudulent e-mail of abc-company.com.
  • Register all company domains that are slightly different than the actual company domain.
  • Verify changes in vendor payment location by adding additional two-factor authentication such as having a secondary sign-off by company personnel.
  • Confirm requests for transfers of funds. When using phone verification as part of the two-factor authentication, use previously known numbers, not the numbers provided in the e-mail request.
  • Know the habits of your customers, including the details of, reasons behind, and amount of payments.

For businesses, it can be challenging to keep track of the increasing number of cyber threats. However, it is imperative to be proactive. That includes making it as difficult as possible for cyber criminals to target your business and being ready to respond should you still fall victim to an attack.

If you have questions, please contact us

If you have any questions or if you would like to discuss the matter further, please contact me, Robert E. Levy, or the Scarinci Hollenbeck attorney with whom you work, at 201-806-3364.

No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.

Scarinci Hollenbeck, LLC, LLC

Related Posts

See all
How Understanding Bankruptcy Trends Can Benefit Your Business post image

How Understanding Bankruptcy Trends Can Benefit Your Business

The bankruptcy legal landscape presents both challenges and opportunities for businesses navigating financial distress. Understanding current bankruptcy trends can help businesses make more informed and strategic decisions. Corporate Bankruptcy Filings Trending Upwards Bankruptcy filings continued to trend upwards in 2024. According to statistics released by the Administrative Office of the U.S. Courts, personal and business […]

Author: Brian D. Spector

Link to post with title - "How Understanding Bankruptcy Trends Can Benefit Your Business"
SEC Takes Actions Against Issuers for Failure to File Form D post image

SEC Takes Actions Against Issuers for Failure to File Form D

In December, the U.S. Securities and Exchange Commission (SEC) announced charges against two privately held companies for failing to file a Form D notice, which is generally utilized for exempt securities offerings. Here, the SEC’s enforcement sends a strong message: compliance with regulatory requirements is not optional and failure to comply can have significant consequences. […]

Author: Kenneth C. Oh

Link to post with title - "SEC Takes Actions Against Issuers for Failure to File Form D"
Redefining Labor Relations: NLRB's Pivot from Abruzzo’s Memoranda post image

Redefining Labor Relations: NLRB's Pivot from Abruzzo’s Memoranda

On February 14, 2025, the Office of General Counsel (OGC) of the National Labor Relations Board (NLRB) under Acting General Counsel William B. Cowen issued Memorandum 25-05, “New Process for More Efficient, Effective, Accessible and Transparent Case handling.” The Memorandum rescinds nearly all of the Memoranda issued by his direct predecessor, Jennifer Abruzzo, setting the […]

Author: Matthew F. Mimnaugh

Link to post with title - "Redefining Labor Relations: NLRB's Pivot from Abruzzo’s Memoranda"
What Are FIRPTA Withholding Requirements? post image

What Are FIRPTA Withholding Requirements?

If you purchase real property from a foreign person or entity, you may be required to withhold taxes from your payment to the seller under the Foreign Investment in Real Property Tax Act (FIRPTA). The federal tax law is designed to ensure that foreign sellers pay any applicable capital gains tax on profits realized from […]

Author: Jesse M. Dimitro

Link to post with title - "What Are FIRPTA Withholding Requirements?"
Does Your Homeowners Insurance Provide Adequate Coverage? post image

Does Your Homeowners Insurance Provide Adequate Coverage?

Your home is likely your greatest asset, which is why it is so important to adequately protect it. Homeowners insurance protects you from the financial costs of unforeseen losses, such as theft, fire, and natural disasters, by helping you rebuild and replace possessions that were lost While the definition of “adequate” coverage depends upon a […]

Author: Jesse M. Dimitro

Link to post with title - "Does Your Homeowners Insurance Provide Adequate Coverage?"
Understanding the Importance of a Non-Contingent Offer post image

Understanding the Importance of a Non-Contingent Offer

Making a non-contingent offer can dramatically increase your chances of securing a real estate transaction, particularly in competitive markets like New York City. However, buyers should understand that waiving contingencies, including those related to financing, or appraisals, also comes with significant risks. Determining your best strategy requires careful analysis of the property, the market, and […]

Author: Jesse M. Dimitro

Link to post with title - "Understanding the Importance of a Non-Contingent Offer"

No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.

Sign up to get the latest from our attorneys!

Explore What Matters Most to You.

Consider subscribing to our Firm Insights mailing list by clicking the button below so you can keep up to date with the firm`s latest articles covering various legal topics.

Stay informed and inspired with the latest updates, insights, and events from Scarinci Hollenbeck. Our resource library provides valuable content across a range of categories to keep you connected and ahead of the curve.

Let`s get in touch!

* The use of the Internet or this form for communication with the firm or any individual member of the firm does not establish an attorney-client relationship. Confidential or time-sensitive information should not be sent through this form.

Sign up to get the latest from the Scarinci Hollenbeck, LLC attorneys!

Please select a category(s) below: