Executive impersonation scams are on the rise, costing businesses billions of dollars annually. Businesses of all sizes can be targeted and fall victim to these crimes. Providing secUnderstanding how these crimes are committed and the numerous variations and vectors of attack will help reduce the possibility that your organization will fall victim.
Let’s face the facts, executives are a target rich environment for cybercriminals! Company executives and the employees that provide support are frequently targeted in these scams.
In this crime, the scammers go to great lengths to compromise or spoof company email or use social engineering to assume the identity of the CEO, executive, company attorney or a trusted vendor or customer.
The criminals do their homework to develop a good understanding of the victims normal business practices. Statistics indicate that victims in these crimes, provide a wide variety of different goods or services and belong to no specific business sector. The criminals might stumble across a compromised business email system though a phishing scam or specifically target a vulnerable business.
The FBI has included this type of crime as a variation of the “Business E-mail Compromise (BEC)” scam. The FBI has defined BEC as a sophisticated scam targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments. The scam is carried out by compromising legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds.1
The FBI’s Internet Crime Complaint Center (IC3) reports several basic scenarios associated to this crime. In many of these cases, the victim businesses used electronic fund transfer EFT; ACH transfers or wire transfers as a method of payment. But businesses that made payments with checks were also targeted.
In this most recent scenario, one or more of the victim companies executives’ email addresses are compromised. Next, an associate employee within the organization responsible for handling W-2’s, payroll or other company employee personal identifiable information (PII) is contacted using the executives email address. Frequently someone in human resources, payroll, finance or audit is targeted. The request by the company executive is often an urgent need for payroll or other PII data. This crime has recently ramped up due to tax season and the associated urgency to get taxes completed.
The next scenario also involves what appears to be the executive as the initiator of the request. The email account of the executive is compromised. The request could be through a hacked or spoofed email address. The criminals often have hacked into the email system and determined the normal business process for EFT transfer. The criminals send the fraudulent executive email to the company employee that normally handles the EFT process requesting the EFT to a customer, vendor or financial institution.
In a variation of the executive wire transfer scam, the executive is targeted with an email that appears to be from a trusted vendor, customer or foreign supplier. The email generally matches prior successful EFT’s that have completed in the past. In many cases, faxes or phone calls corresponding to past legitimate request are also involved.
In this scenario the victim business can be contacted via a hacked or spoofed email account, phone call, fax or text message. The email proports to be from an company executive or attorney claiming to be handling a confidential or time-sensitive transaction. The criminal impersonator will concoct a story that the company is in the process of acquiring another company and the issue is time sensitive and confidential.
In some instances the company executive is contacted from a known suppler, vendor or customer requesting the EFT to be initiated with a sense of urgency.
This is another crime, where security awareness training can help to reduce risk. Insuring that all employees are aware of these crimes will help to stop this crime from happening. Being aware of new crimes and scams in the news is a fundamental part of security awareness training. Insuring that employees, are aware of this scam will greatly reduce the likelihood that your company will be victimized.
The Center for Information Security Awareness, www.CFISA.org has been providing online and in-person security awareness training since 2007. The CFISA security awareness training stresses the importance of educating employees to help reduce company risk and protect against these types of crimes.
Do you need help with security awareness training for your employees? Contact CFISA and we will help you with a training option to fit your budget! Request a quote here.
If you have been using the same “evil empire” phishing testing and snippet training for…
The Health Insurance Portability and Accountability Act (HIPAA) serves as a critical safeguard for the…
Developing the necessary skills is essential in the rapidly changing field of cyber security to…
In an era where digital threats are ever evolving and becoming more sophisticated, staying informed…
As our work environments change, many employees now work from home as well as going…
In the ever-changing landscape of cybersecurity threats, criminal groups like BlackCat and ALPHV pose a…