Protect your company from wire transfer fraud

The Growing Threat of Business Email Scams

Business email fraud attacks occur when cybercriminals request wire transfers in emails that look like they are from business suppliers that regularly request payments. In 2018, business email compromise attacks set a record, according to a 2019 report issued by the Association of Financial Professionals: An astonishing 80% of companies reported email fraud scams in 2018, up from 64% in 2014.¹

“Cybercriminals like wire transfers via business email compromise for good reason,” said Gedetsis. “Amounts of all sizes can be transferred electronically as long as funds in the account are available, and funds are available immediately to the recipient. Once the cash is out the door, it’s gone. And criminals are adept in masking the true identities in their fraudulent emails and making you believe it’s a genuine request.”

Once the wire transfer has been made, it can be a challenge to recover lost funds. “When we issue a recall for a fraudulent wire transfer, it doesn’t mean the victimized company is getting its money back,” said Gedetsis. “It just means we’ve notified the other financial institutions involved of the occurrence of suspected fraud. And the injured party cannot count on the legal system to quickly get its money back, especially if it’s an international transaction. The case may drag on for a long time.” This is only applicable for domestic wires as foreign wires are protected by different regulations.

Common Methods of Email Fraud

Spoofing and hijacking are two of the most common methods used in email attacks:

Spoofing: The emails pretend to be an executive or professional at a vendor. Sent to the company employee responsible for wire transfers, these emails request that funds be sent to the thief’s account.

Hijacking: This involves hacking into a real email account and sending wire requests for transfers to an account controlled by the criminal.

Watch for Red Flags

Here are some common red flags that should raise doubts when you receive a wire transfer request:

Sender uses poor spelling and incorrect or unbusinesslike verbiage. Fraudsters often use language or terminology that is clumsy or incorrect, including misspellings, poor punctuation, and awkward wording.

Email request involves important changes. Be alert to any changes in accounts and customary practices in wire transfer requests. Businesses don’t switch banks and accounts very often, and any change should raise suspicions.

Request is for a large amount or an unfamiliar purpose. Larger-than-typical amounts and requests for unusual reasons should immediately raise questions.

Sender calls the wire a rush request. Cybercriminals want to get you to act quickly. They know that time is not on their side: The longer you take to review a request, the greater the likelihood that they’ll be thwarted.

Sender insists on communication only by email rather than verbal. The sender may claim to be unreachable by phone, thus making verbal verification impossible. The email message might promise verbal contact after the funds have been wired.

Return email is different from the one customarily used. The email address is similar to a valid address but not exactly the same. Sometimes it’s only one letter that’s different.

Sender is not one of your usual contacts. The sender may claim to be the CEO or senior executive of the vendor, believing that—in an effort to be responsive—you may wire funds without verification.

Defend Your Company

While cybercriminals are relentless in their attacks on companies, you can take meaningful action to protect your company from wire transfer fraud via emails:

Use common sense—trust your instincts. Ask questions when dealing with suspicious requests, and don’t be reluctant to do so.

Establish a no-exceptions practice to authenticate return email addresses and account details with every wire transfer request.

When you have any question at all, insist on verifying requests with a trusted source—including the salesperson—using a phone number you know is reliable before you wire funds.

Create approved templates for wires for each company and limit the number of people that may modify them.

Require dual authorization on outgoing automated clearing house (ACH) payments or wires so there are two sets of eyes on payments.

Have established processes on setting up new vendors and editing payment information for existing vendor relationships.

Ensure that all finance professionals handling payment requests at your company understand approval protocols.

Above all, take your time—don’t become a victim.

To learn more about how you can protect your business from fraud, visit Key.com/cybersecurity.