Remember the good old days when fishing for info or money online was just called phishing? We’re an industry built on tech and science, but we do love our artsy synonyms and hyperbole.
If you’ve ever had the pleasure of talking to Rois, our Head of Cyber Governance, you’ll know how she feels about the unreliability of research that looks at Business Email Compromise (BEC), whaling, Friday afternoon scams, and CEO fraud as different types of incidents. IT’S THE SAME THING.
We recently posted a blog about BEC, and we’ve also talked you through whaling and spear phishing, so to close the circle of education on all these types of email threats, here’s a quick guide to CEO fraud.
CEO fraud: the facts
Well firstly, you should know that the FBI calls it Business Email Compromise (cue intense eye rolling). Secondly, it’s not about CEOs committing fraud. And finally, it’s not just about CEOs.
In an age when engagement and transparency are key to topping customer relations practices, most C-level executives will have a profile on a corporate website and social accounts combining marketing-approved streams of consciousness with the occasional personal opinion thrown in. It’s never been easier to build profiles of executives and impersonate their communication styles and that’s why CEO fraud is such an easy win for scammers.
Impersonating someone else in order to gain access to confidential information or money is the crux of the phishing attack, so CEO fraud simply extends that process to scammers masquerading as your boss with a c-level title and tricking you into committing a breach.
Common CEO fraud scenarios
- ‘CFO’ emails accounts to ask for a money transfer to be sent to a supplier – but the account details have changed and it needs to be action urgently.
- ‘CEO’ emails HR to ask for a list of employees and associated financial information to be shared with a new payroll company
- ‘Partner’ at law firm asks paralegal to send conveyancing monies to a new account due to an internal error
A 2019 report by the FBI found that organizations lost an estimated $1.77 billion due to these types of attack and it’s clear to see why. Faced with an end-of-day email from the CEO marked ‘URGENT’, you’d be forgiven for acting on it immediately. Invoice scams are particularly prolific as they play on an employee’s fear of the potential consequences of an unhappy supplier, or partner that could put pause to the organisation’s operations.
Identifying and eliminating CEO fraud
The reason so many phishing attacks come to fruition is that scammers are no longer satisfied with using lookalike email domains, using a lower case ‘L’ for the letter ‘I’ for example. Today, domain impersonation is a simple hack and it makes it impossible for a recipient to identify that the email purporting to come from their CEO is actually a fake.
Contrary to popular belief that email gateway protection, such as spam filters and appliances that weed out emails with malicious content, will protect organizations from domain impersonation, the only sure-fire way to eliminate the threat is with an entirely different (less resource intensive) approach. In the last few years, we’ve seen a wave of action against email impersonation, and global protocols such as DMARC have been widely adopted to tackle email fraud.
How can Red Sift help?
At Red Sift, we enable security-first organizations to successfully communicate with and ensure the trust of their employees, vendors, and customers. Our portfolio includes a number of gold-standard email and domain protection products: OnDMARC and Brand Trust. These are designed to work in unison to block outbound phishing attacks and provide domain impersonation defense for company-wide threat protection.
