Protecting Your Company from Business Email Compromise During Unusual Times

Unusual situations like COVID-19 can make businesses lucrative targets for scammers. Here’s a look at what wire and email fraud looks like today, and how you can help protect your business from both.

According to recent cybercrime statistics, BEC has stolen more than $26 billion dollars from unsuspecting victims worldwide.¹

While intercepting or re-directing a payment can happen through a variety of clever tactics, payments fraud generally comes about when a criminal lies about a situation in order to convince you (or your employees) to send money through a payment or transfer of some kind. The largest emerging threat on the payments fraud landscape right now is a scam called Business Email Compromise (BEC). Here’s what you need to know:

How Does it Work?

Say you’re the business owner or CEO/ CFO of a business (basically, someone with authority to send large amounts of money). A fraudster would get their hands on your email or other online credentials, then posing as you, send instructions to someone in your company to send a payment to a particular account.

Why Does it Work?

Criminals are detail-oriented and do their research. In an email, a fraudster will include details about team members and current projects — and even confidential projects — making the communication appear totally legitimate.

Tip: Training and education may be your strongest tools in protecting your business from potential fraud. Owners should develop strong security habits in both employees and themselves.

What are Some Common Variations?

Business Email Compromise takes a few different forms. Here are a few examples:

Owner/CEO Fraud

This is where a fraudster either hacks into the email of an owner, CEO or other high-ranking executive, or duplicates a domain so it appears an email is coming from the company’s highest ranks. They then send a fake email to request a financial transaction while the executive is travelling for business, typically asking to change routing information for an account or to make an out-of-the-ordinary deposit or transfer. Because the fraudster would have been monitoring email activity and would have done their research, they will often wait for the target to go out of town so that the email recipient can’t verify the request face-to-face. They will also include reasons for not following standard policy or for keeping a request secret: “I plan to make an announcement in the morning. Until then, please don’t tell anyone.”

Tip: Choose passwords that are difficult to guess. Do not share passwords across multiple internet profiles.

A Request for Payment from a Vendor

A fraudster posing as a vendor will email someone in accounts payable and tell them that their account details have changed — and can they please send payment to this new account number instead? Even if your company’s systems aren’t hacked, if your vendor’s email is compromised, a fraudulent request for redirection of funds can appear legitimate.

A lawyer impersonation — In a similar scam, a “fake” lawyer will request a fund transfer for a large transaction to a fraudulent account to settle a legal dispute or pay an overdue bill. The fraudster will convince their target that the transfer is confidential and time-sensitive, so it’s less likely that the employee will attempt to confirm if they should send the transfer.

Businesses using generic and free email accounts are commonly targeted and hacked by fraudsters to be able to send out legitimate emails from the email address unsuspecting to the business. Generic email accounts are monitored and hackers jump in at that right time to redirect a wire payment instruction or invoice payment details by signing into the business email account and submitting a modified email. The hacked email is immediately deleted from the sent items folder minimizing the chance of being detected until the payment is not received.

What Types of Businesses Are at Risk?

Businesses of all sizes have been targeted by Business Email Compromise, and it’s a scam that’s been reported in 80 countries.

While businesses working with foreign suppliers or those that regularly send wire transfers are the most vulnerable, fraudsters are flexible and can adjust their tactics to use other payment methods. So every business needs to treat email requests for funds with caution.

How Can I Protect My Company?

Business Email Compromise — or other variations of payments fraud — are often caused by human error as well as online systems and accounts that are hacked. There are strategies to boost your online security that can be easily implemented — but the most effective way to safeguard your business may be to train your staff/employees. These scams can start when fraudsters use a compromised e-mail and ask for payment accounts and phone numbers to be changed. Ultimately, it takes a person to send a transfer or payment.

Tip: Switch up your communication methods when it comes to verification.

• Online: Sign in to your RBC Online Banking account and click on your loan or line of credit. The next page will display your insurance status. Click on the link that indicates your status. This will take you to a new page, where you can follow the steps to apply for insurance.

• Over the phone: Call our RBC Insurance Service Centre at 1-800-769-2523 to enroll. For Alberta and Saskatchewan clients, call RBC Royal Bank at 1-800-769-2511.

• At your branch: Visit your local branch and ask to speak with a credit specialist, who can assist you with your LoanProtector® Insurance application.

• RBC mobile app: Log in to your RBC mobile app and apply for LoanProtector® Insurance on the account details page.

As hard as you’ve worked to build your business, you need to work just as hard to protect it, but you don’t have to do it alone. One of the steps is keeping a watch on your business’ cash flow. Contact your Relationship Manager to learn more about how we can help you monitor your accounts so you always know where your cash flow stands. See how RBC can help you manage your cash flow, with a range of tools and services built for business owners like you.

Sources:

1. Latest FBI BEC stats.

Share This Article