The FBI’s Internet Crime Complaint Center (IC3) this week said the plague it calls the Business Email Compromise continues to rack-up victims and money – over 40,000 worldwide victims and $5 billion in the latest count.
+More on Network World: FBI/FTC: Watch those e-mails from your “CEO”+
The BEC scam is typically carried out by compromising legitimate business e-mail accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds, the IC3 stated. Most victims report using wire transfers as a common method of transferring funds for business purposes; however, some victims report using checks as a common method of payment. The fraudsters will use the method most commonly associated with their victim’s normal business practices. The scam has evolved to include the compromising of legitimate business e-mail accounts and requesting Personally Identifiable Information (PII) or Wage and Tax Statement (W-2) forms for employees, and may not always be associated with a request for transfer of funds, the IC3 stated.
+ More on Network World: FBI: Extortion e-mail, tech support scam-bags turning up the heat+
“It is largely unknown how victims are selected; however, the subjects monitor and study their selected victims using social engineering techniques prior to initiating the BEC scam. The subjects can accurately identify the individuals and protocols necessary to perform wire transfers within a specific business environment. Victims may also first receive “phishing” e-mails requesting additional details regarding the business or individual being targeted (name, travel dates, etc.)” the IC3 wrote.
Some individuals reported being a victim of various Scareware or Ransomware cyber intrusions immediately preceding a BEC incident. These intrusions can initially be facilitated through a phishing scam in which a victim receives an e-mail from a seemingly legitimate source that contains a malicious link. The victim clicks on the link, and it downloads malware, allowing the subject(s) unfettered access to the victim’s data, including passwords or financial account information, the IC3 wrote.
+More on Network World: FTC warns on “Can you hear me now” robocall: Hang up!+
The impact of the scam is detailed in the IC3 stats released this week including:
- Between January 2015 and December 2016, there was a 2,370% increase in identified exposed losses. The scam has been reported in all 50 states and in 131 countries. Victim complaints filed with the IC3 and financial sources indicate fraudulent transfers have been sent to 103 countries.
- Based on the financial data, Asian banks located in China and Hong Kong remain the primary destinations of fraudulent funds; however, financial institutions in the United Kingdom have also been identified as prominent destinations.
The following BEC/EAC statistics were reported to the IC3 and are derived from multiple sources, including IC3 and international law enforcement complaint data and filings from financial institutions between October 2013 and December 2016:
- Domestic and international incidents: 40,203
- Domestic and international exposed dollar loss: $5,302,890,448
- Total U.S. victims: 22,292
- Total U.S. exposed dollar loss: $1,594,503,669
- Total non-U.S. victims: 2,053
- Total non-U.S. exposed dollar loss: $626,915,475
The following BEC/EAC statistics were reported by victims via the financial transaction component of the new IC3 complaint form. The following statistics were reported in victim complaints to the IC3 from June 2016 to December 2016:
- Total U.S. financial recipients: 3,044
- Total U.S. financial recipient exposed dollar loss: $346,160,957
- Total non-U.S. financial recipients: 774
- Total non-U.S. financial recipient exposed dollar loss: $448,464,415
The IC3 wrote of the biggest trends in the email scam scenario including:
W-2/PII Data Theft: This scenario of BEC/EAC was identified in 2016 in which a human resource department or counterpart was targeted with a spoofed e-mail seemingly on behalf of a business executive requesting all employee PII or W-2 forms for tax or audit purposes. The request appeared to coincide with the 2016 U.S. tax season, which runs from January through April. The number of complaints and reported losses peaked in April 2016, although complaints were still submitted by victims throughout 2016. Victims appeared to be both the businesses responsible for maintaining PII data and the employees whose PII was compromised. In several instances, thousands of employees were compromised. Employees filed identity theft–related complaints with IC3 that included reported incidents of fraudulent tax return filings, credit card applications, and loan applications.
Back to the beginning: The IC3 saw a 50% increase in the number of complaints in 2016 filed by businesses working with dedicated international suppliers. This scenario was described in the earliest BEC/EAC complaints and quickly evolved into more sophisticated scenarios. In some instances, instead of requesting a change in a single remittance or invoice payment, BEC/EAC perpetrators changed the remittance location to redirect all incoming invoice payments. The fraudulent request appeared to be facilitated through a spoofed e-mail or domain.
Real Estate: The BEC/EAC scam targets all participants in real estate transactions, including buyers, sellers, agents, and lawyers. The IC3 saw a 480% increase in the number of complaints in 2016 filed by title companies that were the primary target of the BEC/EAC scam. The BEC/EAC perpetrators could monitor the real estate proceeding and time the fraudulent request for a change in payment type (frequently from check to wire transfer) or a change from one account to a different account under their control.
Check out these other hot stories:
Ultimate geek job? NASA challenges you to jump on the FORTRAN bandwagon!
Arista infringed on two original Cisco patents, ITC finds
Fragmented, disorganized IT systems thwart feds ability to track visas
Extreme offers glimpse of integrated Avaya, Brocade technology future
Cisco bolsters analytics clout with Saggezza buy
Cisco drops critical security warning on VPN router, 3 high priority caveats
Cisco fires back at VMware decision to whack third party virtual switches
Cisco grabs-up SD-WAN player Viptela for $610M
TSA: “As you can imagine, live anti-tank rounds are strictly prohibited altogether.”