We have been seeing an increase in criminal cyber-fraud schemes affecting both large and small businesses, individuals and banks. With the increase in remote work, online payments and email usage, a common fraud we are seeing more of is criminals are using a Business Email Compromise (BEC) hack as a way of posing as the company sending the invoice to the recipient, then upon payment, the payors account gets drained with little to no trace of the criminal tied to the fraud.

So how does it work and what is a BEC?

Business email compromise (BEC) or “phishing” is a technique used to gain access to your company email so criminals can impersonate a co-worker, manager or other trusted business partner to steal sensitive data and money. With access to your business email accounts, criminals can steal money through fraudulent wire transfer requests, fake invoices, diverting payroll and more. Protecting your email is essential. BEC emails usually contain no malware and are therefore difficult to detect with common email filtering means.

How does a typical BEC scam work?

A common technique is email spoofing. Email spoofing occurs when the email appears to be sent by a legitimate sender but is actually sent by a criminal. For example, your accounts payable department receives an email from the CEO (who is traveling abroad) asking for $100,000 to be immediately wired to a new bank account of a trusted business partner. The employee complies. You later discover the new bank account belongs to a criminal who spoofed the CEO’s email account to divert the money. You immediately call the bank but the money has already been transferred. Another example would be a client receiving a legitimate email requesting payment for services. Unknown to them, a hacker has access to their email and replies as the business requesting payment. Yet instead of using the standard payment methods, the criminal spoofs the business emails and requests a wire transfer instead.

Steps you can take to protect yourself and your company:

  1. Enable two-factor authentication on important accounts. These include email, bank accounts, company logins, etc.
  2. Question everything. In todays digital world of email, texting and online paper trails, one of the best preventative measures is to pick up the phone and call the sender of the email. Don’t use the number listed in the email, as it could redirect to the hacker. Instead, look them up in your contact list or on Google. Ask them if they really sent the email and if its legit.
  3. Spam filters and anti-virus protection measures. These should be in place and tested frequently. That being said, they don’t catch everything, which is why steps 1 &2 are equally important.

How to recognize a scam?

  1. Demand. A demand for payment in the form of a wire, cashier’s check or gift card.
  2. Typos. The email will often have poor grammar or spelling errors
  3. Display Name. Don’t always trust the display name – check the senders email address
  4. Salutation. Be wary of “Valued Customer” instead of addressing you by name
  5. Threats. Fear-based phrases like “Your account has been suspended” is prevalent

Awareness is one of the best preventive measures you can take. Linkenheimer will never enforce a payment type, ask for your banking, or credit card information. If you ever have a question about an invoice or an email you receive from us, please reach out to our office at 707-546-0272 and ask. Replying to the email often leads to the criminal replying back (if the email account has been hacked) and many times, they include a false phone number in the fake invoice, so when in doubt, look up the sender and call their number listed on the website. If you have questions, please let us know.