Business E-mail Compromise (BEC) (also called the CEO impersonation scam) is a sophisticated scam targeting businesses that regularly perform wire transfer payments. The FBI states that since 2015, there has been a 1,300 percent increase in losses from this scam. The government estimates that over $1.2 billion was stolen from businesses last year through BEC.

There are many different forms of BEC. The most frequent occurs when hackers break into a company’s computer and then monitor the email activity of the company. According to the FBI, the hacker may spend weeks or months inside the company’s computer, studying its vendors, billing systems, CEO (or other executive’s) style of email communication or travel schedule. The hacker eventually figures out the name of the person in charge of contacting the bank for wire transfers.

If a company is too transparent, the scam-artist may not even need to hack into the company’s computer. The criminal may be able to simply look at personnel descriptions on company websites and figure out who is the boss and who transmits wire instructions to the company bank.

The con-artist may create an email account that is deceptively similar to that of the company. For instance, bob@bobstrucking.com may be the legitimate email address for the CEO. The cyber-criminal may create a phony email, bob@bobstruckimg.com. Using this email address and posing as the CEO, the cybercriminal may send instructions to the comptroller to wire $200,000 to Scotiabank, where the hacker has a bank account. The cyber-criminal will give the comptroller the account number and swift code of the receiving bank together with an instruction to make a speedy transfer. The crook may send the email when the CEO is on vacation or traveling on business.

The comptroller, believing that the instructions are from the CEO, may dutifully contact the bank and send out the wire transfer. Within minutes, the cybercriminals transfer the money to another bank account in yet another country. Eventually, the criminal bosses pick up the money, often using a system of “mules” to physically go to the bank and collect the proceeds of the scam.

The FBI has noted the following characteristics of BEC scams:

• Individuals who are responsible for wire transfers are targeted.
• Spoofed e-mail names closely mimic the real e-mail name.
• Hacked e-mails often occur using a personal (i.e., gmail, yahoo, etc.) e-mail account.
• The request for the wire transfer is accompanied with a sense of urgency.
• The characteristic of the spoofed wire transfer request may be similar to the company’s normal business transactions (i.e. similar vendors, amounts, countries, etc.)
• The hacker’s IP address is traced to a free domain registrar.

The FBI makes the following suggestions:

• Avoid free web-based e-mail accounts. Instead, establish a company web site domain and use it for business transactions.
• Be careful when posting to social media and company websites not to reveal travel schedules or the officials responsible for wire transfers.
• Be suspicious of requests involving pressure to act quickly.
• Consider additional IT and financial security procedures and 2-step verification processes, such as:
  • Alternative communications: Establish other communication channels, such as two-factor authentication or telephone calls, to verify significant transactions.
  • Don’t open spam: Immediately delete unsolicited e-mail (spam) from unknown parties. Do NOT open spam e-mail, click on links in the e-mail, or open attachments. These often contain malware that will give allow hackers to access your computer system.
  • Forward vs. reply: Do not use the “reply” option to respond to business e-mails. Instead, use the “forward” option and either type in the correct e-mail address or select it from the e-mail address book to ensure the intended recipient’s correct e-mail address is used.
• Significant changes: Beware of sudden changes in business practices. For example, if a current business contact suddenly asks to be contacted via their personal e-mail address when all previous official correspondence has been on a company e-mail, the request could be fraudulent. Always verify by other channels (phone calls, office visits, etc.) that you are still communicating with your legitimate business partner.

If you have questions about the Business E-mail Compromise scam, please feel free to contact us. We recommend, however, that you not use your personal email account to make an inquiry with us. We don’t want to be spoofed!

www.swansonhatch.com
431 South Seventh Street, Suite 2545
Minneapolis, MN 55415
612-315-3037

The materials in this article are for informational purposes and do not constitute legal advice, nor does your unsolicited transmission of information to us create a lawyer-client relationship. Sending us an email will not make you a client of our firm. Until we have agreed to represent you, nothing you send us will be confidential or privileged. Readers should not act on information contained in this article without seeking professional counsel. The best way for you to inquire about possible representation is to contact an attorney of the firm. Actual results depend on the specific factual and legal circumstances of each client’s case. Past results do not guarantee future results in any matter.