Business E-Mail Compromise--An Emerging Global Threat

FBI ^ | August 28, 2015

[Brad from Tennessee]

The accountant for a U.S. company recently received an e-mail from her chief executive, who was on vacation out of the country, requesting a transfer of funds on a time-sensitive acquisition that required completion by the end of the day. The CEO said a lawyer would contact the accountant to provide further details.

“It was not unusual for me to receive e-mails requesting a transfer of funds,” the accountant later wrote, and when she was contacted by the lawyer via e-mail, she noted the appropriate letter of authorization—including her CEO’s signature over the company’s seal—and followed the instructions to wire more than $737,000 to a bank in China.

The next day, when the CEO happened to call regarding another matter, the accountant mentioned that she had completed the wire transfer the day before. The CEO said he had never sent the e-mail and knew nothing about the alleged acquisition.

The company was the victim of a business e-mail compromise (BEC), a growing financial fraud that is more sophisticated than any similar scam the FBI has seen before and one—in its various forms—that has resulted in actual and attempted losses of more than a billion dollars to businesses worldwide. . .

[kearnyirish2]

Interesting; I remember the audit classes from college, and then saw the controls in action in the workplace. Much easier to enact with larger staffs; as companies reduce staff levels so many positions are “one-deep”, it becomes harder. You’re right that most things have been done before (maybe with slight variations); competent people should be able to detect theft fairly quickly. I’ve seen things where collusion was necessary (and even then the thefts should have been detected by a third party fairly quickly as well). Simple basic controls (like timely bank reconciliations) go a long way in sniffing things out, but too often overworked staff delay that process.