Statistics indicate that victims in these crimes belong to no particular industry or business sector. The criminals might stumble across a compromised business email system though a phishing scam or specifically target a vulnerable business.

Scenarios

The FBI’s Internet Crime Complaint Center (IC3) reports several basic scenarios associated with this crime. In many of these cases, the victim businesses used electronic funds transfer (EFT), automated clearing house (ACH) transfers, or wire transfers as a method of payment. But businesses that made payments with checks were also targeted.

Scenario #1: Data Theft

In a data theft scenario, one or more of the victim company’s executives’ email addresses are compromised. Next, an associate employee who is responsible for handling W-2 forms, payroll, or other company employee personal identifiable information (PII) is contacted using the executive’s email address. Frequently, the targeted individual is someone in Human Resources, Payroll, Finance, or Audit, and the request by the executive often expresses an urgent need for payroll or other PII data. This crime has recently ramped up due to tax season and the associated urgency to get tax returns completed.

Scenario #2: Executive EFT and Wire Transfer Request

This scenario also involves what appears to be the executive as the initiator of the request. The email account of the executive is compromised; the request could be made through a hacked or spoofed email address. In some cases, the criminals have hacked into the email system and determined the normal business process for EFT transfer. The criminals then send the fraudulent executive email to the company employee who normally handles the EFT process and requests that the EFT be made to a customer, vendor, or financial institution.

In a variation of the executive wire transfer scam, the executive is targeted with an email that appears to be from a trusted vendor, customer, or foreign supplier. The email generally matches prior successful EFTs that have been completed in the past. In many cases, faxes or phone calls corresponding to past legitimate requests are also involved.

Scenario #3: Executive and Attorney Impersonation

This scenario is very similar to scenario #2, but the spoofed sender is not an executive. In this case, the victim’s business can be contacted via a hacked or spoofed email account, phone call, fax, or text message. The email purports to be from a company executive or attorney claiming to be handling a confidential or time-sensitive transaction. The criminal impersonator concocts a story that the company is in the process of acquiring another company and the issue is time sensitive and confidential. In some instances, the company executive is contacted by a known suppler, vendor, or customer requesting that the EFT to be initiated with a sense of urgency.