Imposter Emails Can Be Costly
Challenge:
Business Email Compromise (BEC) is a sophisticated scam targeting businesses that perform electronic payments like wire or ACH transfers. It’s rampant and on the rise. According to the Federal Bureau of Investigation, BEC fraud has rapidly increased since 2019 and caused $43 billion in actual and attempted losses globally.
In a BEC scam, criminals send an email message that appears to come from a known source making a legitimate and typical request, such as a vendor the client regularly deals with. Due to this “imposter” activity, clients may unknowingly authorize ACH or wire transactions that are fraudulent and ask for Pinnacle’s assistance to recover the funds.
For example, a Pinnacle commercial client unknowingly received an email from a fraudster who had likely intercepted an email thread between the client and one of their vendors. The fraudster had then created a new domain and website that looked remarkably like the vendor’s with the exception of one letter in the URL (internet address), using a Q in place of a G.
Because the fraudulent email looked like a typical legitimate email from the real vendor, it was camouflaged alongside valid emails and appeared to be authentic. The fraudulent email contained requests for a change of account information and an ACH transfer of $275,000. The Pinnacle client fulfilled these fraudulent requests.
Solution:
Human behavior is the number one vulnerability in BEC fraud, and education with changed behavior is the primary antidote. Pinnacle educates ACH and wire clients through our onboarding process, articles like this one in our Learning Center and learning events and webinars on cybersecurity. Pinnacle associates are required to complete annual training with tests that require a passing grade.
Best practices for clients include:
- First, scrutinize all email requests for changes or transactions carefully for inconsistencies, grammar and spelling, and precise URLs. Even when the email appears to come from an officer of your company, it may have come from an imposter.
- When online platforms or other sources are available to double-check legitimate charges, clients should log into them separately without using any links from the email in question.
- Further, we recommend clients require that all change of account information requests be verified independently by telephone, using a separate, known phone number. Taking the time for this “due diligence” can ultimately save the company from losses.
Pinnacle has also established thresholds in our system to issue fraud alerts when certain risk criteria are met on wire and ACH services. The system sends an automated email to the financial advisor and assistant, who then contact the client to ensure the change of account information and/or wire request and instructions are valid.
Result:
Unfortunately for the commercial client in this case, there was no remedy for recovery and the client lost $275,000. Pinnacle counseled the client on ways to avoid future losses of this nature.
If you think you’ve fallen for a business email compromise scam:
- Contact your financial advisor or treasury management advisor immediately. With every minute that passes, your chances of recovering funds diminishes.
- Once it’s determined to be fraudulent, contact your local FBI office to report the crime.
- File a complaint with the FBI’s Internet Crime Complaint Center (IC3).