Fraud is a major threat facing nearly every industry. From large corporations to small businesses, fraudsters target a wide variety of individuals in order to amass funds. To stay vigilant and prevent financial loss, employees and business owners need to be aware of the true nature of such crimes and the steps they can take to combat the growing issue.
- In 2020 alone, the FBI reported a loss of almost $2 billion due to business email compromise[1]
- 2.3x more attempts at small businesses vs. large corporations[2]
- 70% increase in FBI cybercrimes between 2019-2020[3]
Many of these losses come from business email compromise. This is a type of fraud where an employee receives an email from a known client or associate who tries to convince the person to redirect money.
Typically, the scenario unfolds in 3 simple steps:
- The fraudster sends an email to an employee (usually involved in accounting or billing) asking about an invoice or payment.
- They’ll ask to change the bank account details such as the beneficiary name, bank or location. Additionally, they might list a reason for this adjustment.
- The employee will adjust the banking details and complete the payment.
Many believe they are immune to such schemes and that attempted fraud must be blatantly obvious. In reality though, the simplicity of the scheme means that many do indeed comply with these requests. Because they are impersonating a client, partner or vendor, their email address and content may closely mirror a real communication.
Business email compromise red flags:
- Asking to change the country of receipt. If a correspondent has always received payment in a particular location, be wary if they suddenly want to shift to another part of the world – especially if they have no business there.
- Asking to change the beneficiary name. How often does your company change the name on their account? The answer is not very often, if ever.
- They give a reason. The fraudster is likely trying to justify their haste by providing details of the change. In reality, such business decisions are private and most companies will keep these decisions to themselves.
- New email address. The domain or alias of the email might be very similar to the real address but even a new dash should be noted. In some cases, the email might even be identical.
- Spelling. If the grammar, spelling or sentence structure is off, this is a clear sign that something is amiss.
- Message size. If the invoices suddenly look different or vastly change in file size (200k instead of the usual 1mb), take an extra look.
- Urgency. If the sender seems in a hurry to gather funds and sends multiple follow-up emails, this is a big sign that the sender is a fraud.
The best way to combat fraud is to be vigilant and enact a multi-factor authentication process. Quite simply, this means that any financial change requested through email should be verified through another method. Call the client and double check their email address against previous correspondence. This simple step could save a huge amount of money, not to mention reputational loss for the company.
The best way to combat fraud is to be vigilant and enact a multi-factor authentication process. Quite simply, this means that any financial change requested through email should be verified through another method. Call the client and double check their email address against previous correspondence. This simple step could save a huge amount of money, not to mention reputational loss for the company.
- Fraudsters only target CEOs: These ploys actually affect employees at multiple levels. Anyone who manages payments and invoicing is a potential recipient of these emails.
- If you contact a partner to confirm a suspected fraud email, they will be annoyed: Most vendors/associates/clients will appreciate that your company has multiple layers of security.
- If you have lost money to a fraudster, it is impossible to recover: Recovering money from a scheme is difficult but not impossible.
Fraud can be a costly and difficult problem for all businesses. If you suspect business email compromise or fraud, immediately contact your Convera representative. Do not further email the fraudster or send additional funds. Verify any changes with your real vendor/associate via telephone. These incidents can be overwhelming but are also preventable.
[1] Source: FBI https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf
[2] Source: PYMNTS https://www.pymnts.com/news/b2b-payments/2021/data-digest-business-email-compromise/
[3] Source: APN News https://www.apnnews.com/business-email-compromise-schemes-caused-1-8b-worth-of-damage-a-100m-increase-in-a-year/
Disclaimer:
Convera has based the opinions expressed in this webpage on information generally available to the public, and such information or opinions are strictly for illustrative purposes only. Business between you and Convera shall be governed by the applicable terms and conditions provided to you before you undertake any transaction or commercial relationship with Convera.
