You should always double-check new account numbers.
Fraudsters might try to sneak a bogus invoice into your accounting department.
They could be monitoring your email conversations and take over the conversation when it comes to talking about invoices or even send you an email that looks like it comes from your CEO or CFO.
These emails are often very well prepared and even written in your company lingo or format.
You must have procedures in place to verify new accounts or changes to older accounts by other means than just email.
There has been a huge increase in the volume of business email compromise scams and estimates show huge losses.
Like normal phishing scams, these kinds of attacks rely on highly believable messages and a healthy dose of social engineering to get the job done.
Typically, an attacker will send an email to a victim inside an organization, saying that funds need to be transferred immediately to an outside account.
The email usually has a spoofed sender address and appears to come from the CEO, CFO, or other top executive inside the target company.
The schemers go to great lengths to spoof company e-mail or use social engineering to assume the identity of the CEO, a company attorney, or trusted vendor.
They research employees who manage money and use language specific to the company they are targeting, then they request a wire fraud transfer using dollar amounts that lend legitimacy.
There are various versions of the scams. Victims range from Large Corporations, Financial Services, Tech companies, Small Businesses, Health and Non-Profit Organizations.
Fraudsters would also specifically target businesses that work with foreign suppliers or regularly perform wire transfer payments.
Recently details emerged of an attack on Mattel that nearly cost the company $3 million. A finance executive at the company got an email from what seemed to be the CEO, asking her to send a payment of $3 million to one of the company’s vendors in China. She did, and only after checking with the CEO realize that he hadn’t sent the email.
The company worked with the United States and Chinese law enforcement and got the money back a few days later, something that is a rarity with these attacks.
Crelan Bank in Belgium lost $75 million in a similar scheme, and a manufacturing company in Austria lost about €50 million in a phishing scheme, too.
Key takeaways:
Invoices can be sent out by hackers using a company name you know
Hackers could be following your email to get information, emulate lingo and take over the conversation
Always double check new bank information in person or with a phone call
About CyberAweh
We offer fast easy enjoyable online Cyber Awehness training
You will notice that we call it Awehness training purposefully sending out greetings of Respect Love and Gratitude. We practise physical distancing by standing two meters apart with palms pressed together or hands folded together omitting a feeling of Love Respect and Gratitude and sometimes with a touch of humour proclaiming “AWEH”
Our training is really next generation, designed to inspire maximum attention and retention. The videos are short, insightful, and enjoyable with a touch of humour.
We urge you to have a bash and benefit from our limited no obligation sample course.
Send an email to info@cyberaweh.co.za provide your email address and receive a free sample course
Spend 5 minutes of your time and gain valuable insights on how to protect you and your organisation from the nasty perils of cybercrime.www.cyberaweh.co.za