Invoice Scams – Business Email Compromise
For two years, between 2013 and 2015 Evaldas Rimasauskas, sent out a slew of invoices to Google and Facebook with which he managed to extract 172M USD. He did get caught and most of the money was recovered, mainly due to the resources available to the companies that were scammed. Large and small concerns are equally at risk.
Business Email Compromise - Google and Facebook
The USA FBI reported that they were aware of 3B USD worth of fraud committed between 2013 and 2019 due to business email compromise.
Read the image description and data table
Source: Internet Crime Complaint Center (IC3), the historical table reproduced in the original article. Descriptors recorded separately were Social Media: $66,401,318 and Virtual Currency: $28,302,365. These descriptors identify the medium or tool used and are recorded only after another crime type has been selected; they are not additional crime categories.
| Crime type | Reported loss in US dollars |
|---|---|
| BEC/EAC | $360,513,961 |
| Confidence Fraud/Romance | $219,807,760 |
| Non-payment/Non-Delivery | $138,228,282 |
| Investment | $123,407,997 |
| Corporate Data Breach | $95,869,990 |
| Other | $73,092,101 |
| Advanced Fee | $60,484,573 |
| Personal Data Breach | $59,139,152 |
| Identity Theft | $58,917,398 |
| Civil Matter | $57,688,655 |
| 419/Overpayment | $56,004,836 |
| Credit Card Fraud | $48,187,993 |
| Real Estate/Rental | $47,875,765 |
| Employment | $40,517,605 |
| Phishing/Vishing/Smishing/Pharming | $31,679,451 |
| Harassment/Threats of Violence | $22,005,655 |
| Lottery/Sweepstakes | $21,283,769 |
| Extortion | $15,811,837 |
| Misrepresentation | $13,725,233 |
| Government Impersonation | $12,278,714 |
| Denial of Service | $11,213,566 |
| Tech Support | $7,806,416 |
| IPR/Copyright and Counterfeit | $6,829,467 |
| Malware/Scareware | $3,853,351 |
| Ransomware | $2,431,261 |
| Re-shipping | $1,932,021 |
| Charity | $1,660,452 |
| Spoofing | $1,653,532 |
| Health Care Related | $995,659 |
| Gambling | $290,693 |
| Terrorism | $219,935 |
| Crimes Against Children | $79,173 |
| Hacktivist | $55,500 |
| No Lead Value | $0 |
Business Email Compromise - some tell-tale signs
Stressors events
- Scammers usually instil urgency in their request / demand
- The request may appear to come from the CEO/COO/CFO
- It may be a time limited opportunity; They're likely to have done their research and choose a time when a large transaction or a takeover bid is occurring for example
Copy-cat or similar email domains
If your company name is bestproducts.com and your accountants are numbercrunchers.com, then you may get messages from or youraccountant@numbercruncherṣ.com or myceo@bestprơducts.com. Letters like lowercase L, l may look like 1 etc
Change of bank account details
This one is easily mitigated, but it requires time to check and some countries don't check the beneficiary details (such as the UK).
Use of non-standard communications
For example if a supplier usually uses email, then they switch to Whatsapp or Lync for privacy for instance, it is worth validating and being sure.
A great example of social engineering and using stressor events (thanks RS for showing me this one).
What to do if you think you’ve been scammed
First of all keep calm. If you have used bank transfer, contact your bank and explain the situation to them, obviously you will need to be sure that the person you speak to is genuine.
Report the incident to
https://www.actionfraud.police.uk/if you’re based in the UK.
What else can you do?
Way back in 1597, Francis Bacon said
"Knowledge is power"
So be informed, train your employees (especially the executives, see spear phishing and whaling) to
- Recognise these types of scams (not to be intimidated into breaking from set procedures)
- Four-eyes check procedure
- Validate purchase orders and invoices
I publish a weblog, so do take a look if this sort of thing is of interest.
Personal commentary. Views are the author’s own.