Targeted Phishing Serves as a Reminder to Put Wire Transfer Safeguards in Place

Phishing is a big part of the cybercrime industry. Targeted phishing, more specifically spearphishing or whaling, is not only gaining momentum, but has become a giant thorn in the sides of all industries. The FBI continually releases notices and warnings about the dangers of this social engineering tactic that has led to significant losses due to business email compromise (BEC) or email account compromise (EAC). Last year, this type of crime surpassed the $5.3 billion in losses mark and is expected to continue that upward trend.

Masquerading is a way to further describe a spearphishing tactic and surprisingly does not involve account takeover or malware. Instead, the criminal uses social engineering to try and trick the user into thinking he or she is someone who has executive level authority, generally to initiate wire transfers or pay invoices. Therefore, the targets are often in the accounting or administrative departments who perform wire transfers on a company’s behalf. In some cases, the hackers may pretend to be a vendor requesting payment of an invoice. Often, well-known company names such as Federal Express or PayPal are used in this way.

A particularly dangerous detail is that these email messages don’t have a link to click or an attachment to open; therefore it catches people off guard. They don’t necessarily suspect it is anything of concern. In one recent case, real PayPal accounts were being opened by cybercriminals who used them to invoice companies from within PayPal itself. This was especially tricky, because there was no evidence that the accounts were fake.

Any organization that performs wire transfers should put safeguards in place to avoid BEC situations. This includes educating employees of the need to authenticate any transaction before submitting a wire transfer request to its financial institution. It’s also advised to use a multi-person approval process so that no transfer can take place without more than one person explicating stating that it is approved. There should also be some measure to get voice or preferably signature approval outside of email in order to initiate a wire transfer request.

Email is easy to spoof, even for those who are not especially technical. Therefore, financial institutions wiring money on behalf of customers should consider putting a call back process in place to verify transactions as well.

The FBI continues to warn businesses about these schemes and updated its warning in early May of this year emphasizing that many industries are being targeted, but none are immune to this. This type of fraud has been reported in every US state and in 45 countries. Therefore, it’s not just an issue within the United States and it’s not likely to go away soon.