CEO Email Scam Costs Companies $2.3 Billion
The FBI recently warned about a “dramatic” increase in so-called “CEO fraud,” scams in which the attackers spoof an email from the boss and trick someone at the organization into wiring funds to fraudsters. The FBI estimates these scams have cost organizations more than $2.3 billion in losses in the past three years.
In an online alert, the FBI said that since January 2015, the agency has seen a 270 percent increase in identified victims and exposed losses from CEO scams. The alert noted that the scam is operating in every U.S. state and at least 79 countries.
It typically begins with thieves phishing an executive and gaining access to an email inbox, or emailing employees from a look-alike domain name. They may replace the letter “l” in a domain name with the number “1,” for example.
Unlike traditional phishing scams, these spoofed CEO emails rarely set off spam traps because they are not mass e-mails. Also, the crooks behind them take the time to understand the target organization’s relationships, interests and travel or purchasing plans.
The FBI estimates that organizations victimized by CEO fraud attacks lose on average between $25,000 and $75,000.
These attacks succeed because they rely almost entirely on tricking employees into ignoring or sidestepping basic security precautions.
Consider these strategies for avoiding such an attack:
-
Educate employees so they are less likely to fall for these scams;
-
Adopt the attackers’ practice of continually testing users’ awareness by testing to identify problematic users. Add security controls to those users.
-
Adopt two-step or two-factor authentication for email, where available, and establish other communication channels—such as telephone calls—to verify significant transactions.
- Exercise restraint when publishing information about employee activities on your website or through social media.
Source: KrebsonSecurity.com