FBI Alert: Business Email Compromise Hits $3 Billion

Business email compromise (BEC) fraud is on the rise and in no small numbers. The FBI has warned in a new public service announcement (PSA) that the actual and attempted loss to businesses due to fraudsters posing as CEOs is now at $3.1 billion between October of 2013 and June of 2016. In just four months, the dollars lost increased by $.8 billion (last reported in February 2016). This is an indicator that BEC may be a bigger problem than previously thought. Therefore, it is important to train staff how to avoid it.

Phishing in this case specifically means spearphishing. Business email compromise scams start with a targeted attack against someone who typically has access to financial accounts for the business and who can complete wire transfers or perform other financial transactions.  The impostors will do research to find out who that may be within the organization they are targeting. They use the company’s website, social media, and LinkedIn, to name a few, in order to gather information necessary. Then they send email to those who can perform the task attempting to get them to wire funds to their bank account.

What anyone puts on social media and other publicly accessible sites should not include details that may allow them to get caught up in this type of scam. When using positions and titles, it’s better to stay more general in describing titles and job duties. It’s probably a good bet that a controller has access to wire funds; so instead of putting in that title, perhaps write “accounting” instead of the title. It’s still a risk, but less of one.

Training others on how to identify BEC phishing attempts is critical. This is by far the number one way criminals infiltrate businesses. Look out for typos and grammatical errors, odd greetings, and verbiage that sounds rushed. For example, if it’s stated that “there’s no time” to verify or follow procedures, it should be met with even more skepticism.

Implement a process that requires multiple approvals before wire transfers can be completed. Then make sure they are followed and that ramifications are included and passed down if needed. Part of the process should include phone calls if the request is a large dollar amount and to confirm all requests. The reply button should never be used to verify this.

This scam has been reported in all states in the U.S. The FBI’s Internet Crime Complaint Center (IC3) has received 15,688 reports of BEC from all over the world.  Over 14,000 of them were U.S. victims.