by Timothy Sexton & De’Andre Hardy, Commerce Bank

If you’ve never experienced the nightmare of fraud, you may not realize how prevalent it really is. According to the Association of Financial Professionals’ (AFP) 2019 Payments Fraud and Control Survey Report, 82 percent of financial professionals report attempted and/or actual payments fraud in 2018. And while check fraud is declining, the percentage of organizations falling prey to Business Email Compromise (BEC) scams has increased from 64 percent in 2014 to 80 percent in 2018 according to the report. Indeed, while technology is making electronic payments easier, it’s also helping bad actors attack those same payment methods.

What is a BEC attack?

In a BEC attack, a thief poses as a high-level executive or employee to instruct others to transfer money to a controlled account. The thief then withdraws the funds. When a high-level executive’s email is compromised, it is frequently referred to as CEO compromise. In that scenario, the fraudster poses as the CEO and emails an employee that typically handles transfers. The email includes urgent instructions for wiring an amount of money to a specified account. 

If an employee’s email is compromised, the fraudster will often use their contact list to instruct customers to send payments to an account. In the majority of BEC scams, once

the fraud is discovered it is too late for the funds to be recovered.

BEC scams target small, medium and large businesses in every industry as well as personal transactions. Between December 2016 and May 2018, there was a 136 percent increase in identified global exposed dollar losses. The scam has been reported in all 50 states and in 150 countries and has cost over 14,000 U.S. businesses almost a billion dollars in

losses. Victim complaints filed with the Internet Crime Compliance Center (IC3) and other financial institutions indicate fraudulent transfers have been sent to 115 countries. 

How it works.

BEC fraudsters impersonate CEOs and employees in a few different ways. In one form, they use phishing techniques to gain access to the target’s email account. The employee might receive an email that contains a malicious link or attachment, which infects their computer with malware when clicked. The fraudster can then take control of the target’s computer or gain additional proprietary information. They can also use the target’s email account to send emails directly from their address.

Sometimes, instead of breaking into an email account, a fraudster will mimic the target’s email address. They may set up a domain that is similar to the company’s web address: for instance, .co instead of .com. This allows them to create an email address that is nearly

identical to that of the target. The fraudster can then pose as the CEO or employee in order to send fraudulent instructions.

To ensure their emails are convincing and effective, fraudsters often study their targets and the company. They analyze email history, corporate website data, contact lists and social media accounts to understand company processes, roles and the characteristics of their target. In CEO compromise, this can also give them a sense of the CEO’s travel schedule, and BEC attacks are often timed for when they will be out of the office. In that case, the employee is unable to verify the request with the actual CEO.

Through their reconnaissance, fraudsters are also able to prey upon new employees who are not trained or experienced with transfer requests for the organization; lack of controls around money transfer requests received via email or phone, and insufficient authentication processes for initial requests.

The cost of fraud.

So, what does all this attempted and actual fraud cost the companies involved? The AFP report shows some respondents experiencing losses $2 million or more from successful fraud attacks. But financial loss isn’t the only issue. Company leaders are well aware that fraud can expose confidential company information and adversely affect an organization’s reputation.

All of this begs the question: What is your firm doing to protect itself against the growing threat of payment fraud? Better yet, what are your critical partners (banks, insurance companies, investment firms) doing to protect your accounts with them?

Above all else, your critical financial partners should be well aware of fraud tactics and how to recognize them. Not only should they be keeping their employees up to date on the latest schemes, but they should be educating their clients on how to spot fraudulent attempts to gain access or information that could compromise your company.

Here are 10 strategies to help your firm mitigate fraud:

1. Dual Controls: Dual control approvals completed from separate computers help protect against multiple users’ credentials being captured on a single infected device.
2. Separation of Duties: A separation of duties between the individual verifying activity/reconciling accounts and the staff person(s) with authority to originate transactions protects a single bad actor initiating a fraudulent scheme alone.
3. Secure Location: Position computers used to transact business in a secure location.
4. Internet Security: Ensure your device has current anti-virus software and all operating system and application updates and patches. Firewalls should be enabled if possible.
5. Dedicated PC: Devote dedicated computers for online financial transactions.
6. Email Security: Train employees to recognize phishing email and how to identify potential threats in email and instant messages.
7. Verify Transactions: Always carefully and thoroughly verify transactions for authenticity and promptly reconcile accounts.
8. Utilize Controls: Any partner software should feature controls that help limit exposure and require secondary review and approval of funds transfer activity.
9. Password Protection: Remind users to maintain strict confidentiality of login/authentication credentials, e.g., IDs, passwords, PINs, and (if applicable) fobs.
10. Patch Management Policy: Ensure your company has an established Patch Management Policy and that it covers third-party client software such as Adobe, Flash and Java.

BEC attacks are targeted, strategic and convincing, but they are not foolproof – and most security professionals agree that almost all fraud is preventable. The challenge is helping employees recognize suspicious communications and inquiries and supporting them with technology that fills in the gaps A discerning eye and quick phone call can be all it takes to stop a BEC scam. Incorporating this emerging threat to your organization’s training on security threats can help spread awareness, advocate best practices and improve precautions against cyber theft.

At Commerce Bank, our customers are at the center of all that we do. And we do a lot, from helping families plan for their future to giving businesses more room to grow. Fortunately we have over 150 years of experience and many strong, established products to back us up. From Bloomington, Illinois to Denver, Colorado, and at 184 branches in between, we serve individuals, families, businesses and communities at the local branch, the ATM, online and through our 24/7 customer service line. Please visit us at https://www.commercebank.com.