FBI Issues Warning About Increase in Business Email Compromise Scams

Cyber fraud takes many shapes and sizes. The latest trend taking center stage involves email scams and companies of all magnitude. Large, small, or somewhere in between, businesses around the world are feeling the heat from email cybercrooks. The FBI reports over $1.2 billion in damage of this type, also called masquerading schemes or business email compromise attacks, within the past two years and has issued an alert to businesses to watch out for it. This is forcing many companies to take a second look at their situations.

As with many cyber scams, some businesses are not reporting the crime. However, according to the numbers that are provided, these are indeed rising. More and more companies realize they’ve been duped and are wondering how they can keep it from happening again.

The short answer is to educate employees who perform financial transactions and make sure a process is in place to verify all wire transfers or anything that involves sensitive business data. Just having the process in place is not enough, however. It also needs to be enforced.

Typically, these scam begin when an email is sent to a company controller or other financial officer appearing legitimate asking for money to be transferred to an account somewhere. This could be for payment to a vendor or for some other authentic-sounding reason. These emails often have an urgent nature. Validating them often goes by the wayside in an attempt to take care of the “pressing matter” at hand. Many of these transactions involve overseas banks in China and new accounts, adding to the anxiety of a speedy settlement. 

Because there is not yet much regulation for controlling this internationally, experts worldwide are suggesting ways to combat these socially engineered transactions:

• Involve your financial institution. Even if you feel it’s too late and the damage has been done, call the customer service number and let them know what happened.

• At any point during a transaction where you are asked to make a financial transaction or provide sensitive data, should you begin to have the slightest doubt about the “vendor” authenticity, contact your financial institution. Making them aware of your situation not only protects you in the future, but also helps others facing the same scams.

• Verify the requestor and the request with urgency. Follow a process for confirming such transactions are indeed intended. Use the intensity cybercrooks use to fool you and turn it around. Even though cyber thieves do everything to convince you they’re legitimate, time spent verifying their identity can make a huge difference to the bottom line. Unfortunately, victims of email scams find after the fact that there was plenty of time to be vigilant.

• Implement a purchase order model for transferring money around and require a reference number or code for each one. Audit the transfers daily.

• Make sure there are multiple approvals for large dollar amounts and that there are separation of duties.

• Train employees to identify fake email addresses and teach them never to open links or attachments in email messages without verifying their legitimacy.

• Before you act, react. Suspicion can be put to rest by adding layers to your vendor approval process. Something as simple as asking for a photo of the requestor’s driver’s license can make cybercrooks think twice about making you a target.

This scam has been reported in all 50 states and in 79 countries and affecting nearly 10,000 businesses worldwide.