Wire Fraud Through Email Masquerading Becoming Big Business

Email is a big part of our work life and the cyber criminals know it. That’s why phishing is such a big crime industry.  Targeted phishing, more specifically spearphishing, is gaining momentum and becoming a bigger concern for financial institutions. A bank fraud prevention officer at Bank of the West predicts that that losses due to wire fraud in the United States which uses masquerading schemes may exceed $1 billion in 2015.

Masquerading is a way to further describe a spearphishing tactic and surprisingly does not involve account takeover or malware. Instead, the criminal uses social engineering to try and trick the user into thinking he or she is someone who has executive level authority, generally in order to initiate wire transfers. Therefore, the targets are accounting or administrative personnel who actually perform wire transfers on a company’s behalf. In some cases, the hackers may pretend to be a vendor requesting payment of an invoice.

A particularly dangerous detail is that these email messages don’t have a link to click or an attachment to open; therefore it catches people off guard. They don’t necessarily suspect it is anything of concern.

Any organization that performs wire transfers should put safeguards in place to avoid becoming a victim these crimes. This includes educating employees to authenticate any transaction before submitting a wire transfer request to its financial institution. It’s also advised to use a multi-person approval process so that no transfer can take place without more than one person explicating stating it is approved. There should also be some measure to get voice or preferably, signature approval outside of email in order to make a wire transfer request. Email is easy to spoof. Financial institutions wiring money on behalf of customers should do call-backs to verify transactions.

The FBI warned businesses about this fraud a year ago and updated their warning earlier this year indicating that these schemes have been reported in every US state and in 45 countries. Therefore, it’s not just a US issue. It reported that global fraud losses associated to business email compromises in general were $214 million between October of 2013 and November of 2014, which some say may be on the low side.