Editorial · November 5, 2016
Business Email Compromise: How Invoice Scams Work
Business email compromise is a scam where a crook uses a fake or hacked email to trick a worker into sending money. The FBI's Internet Crime Complaint Center (IC3) put the exposed losses at more than $3 billion in a June 2016 alert. Small firms and large firms were both hit. The good news is that a few plain habits stop most of these attempts.
What the scam is
The FBI calls it a sophisticated scam. It targets businesses that work with foreign suppliers or that often pay by wire transfer. The crook gets into a real business email account, or copies one so closely that it looks real. Then the crook asks for a payment.
Most victims paid by wire. Some paid by check. The crooks use whatever method the victim normally uses, so the request looks routine.
Source: FBI IC3, Business E-mail Compromise: The 3.1 Billion Dollar Scam, alert I-061416-PSA, June 14, 2016.
How big it has become
The numbers grew fast. In August 2015, the FBI said exposed loss had passed $1.2 billion. By June 2016 it said identified exposed losses had risen 1,300 percent since January 2015.
- 22,143 victims, with $3,086,250,090 in exposed loss, from all sources combined.
- 14,032 U.S. victims in IC3 complaints from October 2013 to May 2016, with $960,708,616 in exposed loss.
- Victims in all 50 states and 100 countries.
"Exposed loss" counts both money actually lost and money that crooks tried to take. Most of the fraudulent transfers went to Asian banks, mainly in China and Hong Kong.
Sources: FBI IC3 alerts I-082715a-PSA (August 27, 2015) and I-061416-PSA (June 14, 2016).
The five common versions
The FBI sorted the complaints into five scenarios.
- Foreign supplier. A firm with a long-term supplier is told to send an invoice payment to a new account.
- Executive request. A hacked or spoofed email from a top manager asks for an urgent wire. It often goes to the person who handles payments.
- Hacked personal email. A worker's personal account is taken over. The crook sends fake payment requests to that person's contacts.
- Lawyer impersonation. The crook claims to be an attorney on a secret matter and presses for quick, quiet payment.
- Data theft. The email asks for W-2 forms or a list of staff personal data. It goes to human resources, bookkeeping or audit staff. The FBI said this version first showed up just before the 2016 tax season.
Source: FBI IC3, alert I-061416-PSA, June 14, 2016.
How the crooks get in
The FBI said it is largely unknown how victims are picked. The crooks do study their targets first. They learn who can move money and how the firm handles wires. Some send phishing emails to collect names, travel dates and other details.
Some victims also reported malware just before a scam. A worker clicks a link in a message that looks real. The link installs software that gives the crook access to passwords and bank details.
Source: FBI IC3, alert I-061416-PSA, June 14, 2016.
Simple checks that help
These steps come from the FBI's advice. None of them needs special software.
- Confirm any unusual payment request by a second channel. Call a number you already had on file. Do not use the number in the email.
- Treat secrecy and urgency as warning signs. So is a sudden change in how a contact writes or talks.
- Require a second person to approve any change to a vendor's bank details.
- Use your own company domain for business mail, not a free web email account.
- Turn on two-factor authentication. Skip unknown links and unexpected attachments.
- Register domain names that look close to yours, and filter mail that uses them.
The Federal Trade Commission's guide, Start with Security, adds a base layer for small firms. It tells businesses to require strong passwords and sound sign-in methods, and to control who can reach sensitive data. It also asks firms to secure remote access to their networks.
Sources: FBI IC3, alert I-061416-PSA, June 14, 2016; Federal Trade Commission, Start with Security: A Guide for Business.
If you already sent the money
Move fast. The FBI says to call your bank at once and ask it to contact the bank that received the wire. If the wire was recent, contact your local FBI office as well. File a complaint at IC3.gov, whatever the dollar amount. Label it "BEC" and include the transaction details.
Speed matters because money that has moved on is hard to pull back. A short call to your bank in the first hours can make the difference.
Source: FBI IC3, alert I-061416-PSA, June 14, 2016.
Sources
- FBI Internet Crime Complaint Center, Business E-mail Compromise: The 3.1 Billion Dollar Scam, June 14, 2016 (ic3.gov/media/2016/160614.aspx)
- FBI Internet Crime Complaint Center, Business Email Compromise, August 27, 2015 (ic3.gov/media/2015/150827-1.aspx)
- Federal Trade Commission, Start with Security: A Guide for Business, June 2015 (ftc.gov/system/files/documents/plain-language/pdf0205-startwithsecurity.pdf)