At Antonoplos & Associates, your security is our top priority. We are dedicated to safeguarding you from the dangers of fraud, and one significant threat we want to address is email spoofing. This deceptive tactic involves the creation of fraudulent emails with forged sender addresses, often designed to appear legitimate. These messages aim to deceive recipients into taking actions that could compromise their confidential financial information. It is crucial to stay informed about the signs of such scams to protect your business from potential losses resulting from fraudulent wire or payment requests.
Detecting a Scam
Scammers often employ tactics that raise red flags, such as:
Urgent Requests: Be cautious of messages that convey a sense of urgency or demand strict confidentiality. These may include requests for:
- Updates to payment instructions.
- Changes to a company’s internal profile.
- Addition of new contacts claiming to represent a business.
- Requests for new payments related to business transactions.
- Sudden changes in established business practices.
- CEO Email or Spear-Phishing: Scammers may impersonate senior executives through fraudulent emails, primarily targeting HR or Finance departments. These emails aim to extract confidential information or initiate unauthorized wire transfers. This tactic is known as spear-phishing.
Messages from Vendors: Beware of emails that appear to be from trusted vendors but seek to collect confidential information or alter payment instructions.
What to Look For
When assessing emails for authenticity, pay attention to subtle variations in email addresses or misspellings compared to the legitimate addresses you expect. For example, if the trusted address is “john.doe@trustedpartner.com,” spoofed emails might resemble “john.do@trustedpartner.com,” “jon.doe@trusted partner.com,” or “john.doe@trusted-partner.com.”
Additionally, be cautious if an email redirects you to a link controlled by the sender, especially when asked to provide confidential information.
Fraudsters may claim that your company has changed banks and request updates to payment instructions. They often monitor email activity closely, gaining insight into invoices, amounts, dates, and other critical information. Once funds are transferred, recovering them becomes nearly impossible.
Attorney Email Scam: Scammers may send emails posing as attorneys, often related to business acquisitions, major transactions, or legal matters. They may request strict confidentiality for what appears to be a time-sensitive issue. These emails may contain threats, such as subpoenas, seemingly aimed at obtaining confidential information.
Non-Financial Data Phishing Scheme: Be cautious of requests for personal information, including social security numbers, phone numbers, and addresses. This data can be used for future malicious activities.
Targets of Cybercriminals
Cybercriminals tend to focus on employees with specific job functions related to authorizing or executing accounts payable operations, such as corporate executives, human resources personnel, or corporate finance staff.
Crucial Precautions
While these precautions are not new, they are essential in today’s digital landscape. To protect your organization, consider adopting these multi-layered security measures:
- Verification: Always verify any new or modified payment instructions through means other than email. We recommend making a phone call for verification.
- Secure Communication: Never send account information via email, not even to the bank.
- Dual Control: Implement dual authorization for all transaction initiations, especially for ACH or wire transfers. This involves one person initiating the transaction and another person approving it.
- Know Your Banker: Establish a strong relationship with your banker. They may call to verify a person or transaction, using personal information you’ve shared to confirm your identity.
- Email Tagging: Have your IT department tag all external email for easy identification of spoofed email messages.
- Avoid Clicking on Suspicious Links: Refrain from clicking on links or opening attachments from unknown senders. Instead, call to verify the sender’s authenticity.
- Hover Over Links: Hover your cursor over links in emails, social media, or websites to check if they match the expected destination. Malicious links often differ from the displayed text.
- Avoid “Reply” to Suspicious Emails: Do not reply to suspicious emails, as this may inadvertently communicate with fraudsters.
- Confirmation Procedures: Develop clear confirmation procedures, such as contacting the sender using known vendor information, defining approval processes for new account numbers, and requesting additional information to verify requests.