A fish, whale and CEO walk into a bar

Remember the good old days when fishing for info or money online was just called phishing? We’re an industry built on tech and science, but we do love our artsy synonyms and hyperbole. 

If you’ve ever had the pleasure of talking to Rois, our Head of Cyber Governance, you’ll know how she feels about the unreliability of research that looks at Business Email Compromise (BEC), whaling, Friday afternoon scams, and CEO fraud as different types of incidents. IT’S THE SAME THING.

We recently posted a blog about BEC, and we’ve also talked you through whaling and spear phishing, so to close the circle of education on all these types of email threats, here’s a quick guide to CEO fraud. 

CEO fraud: the facts

Well firstly, you should know that the FBI calls it Business Email Compromise (cue intense eye rolling). Secondly, it’s not about CEOs committing fraud. And finally, it’s not just about CEOs.

In an age when engagement and transparency are key to topping customer relations practices, most C-level executives will have a profile on a corporate website and social accounts combining marketing-approved streams of consciousness with the occasional personal opinion thrown in. It’s never been easier to build profiles of executives and impersonate their communication styles and that’s why CEO fraud is such an easy win for scammers.

Impersonating someone else in order to gain access to confidential information or money is the crux of the phishing attack, so CEO fraud simply extends that process to scammers masquerading as your boss with a c-level title and tricking you into committing a breach.

Common CEO fraud scenarios

  1. ‘CFO’ emails accounts to ask for a money transfer to be sent to a supplier – but the account details have changed and it needs to be action urgently.
  2. ‘CEO’ emails HR to ask for a list of employees and associated financial information to be shared with a new payroll company
  3. ‘Partner’ at law firm asks paralegal to send conveyancing monies to a new account due to an internal error

A 2019 report by the FBI found that organizations lost an estimated $1.77 billion due to these types of attack and it’s clear to see why. Faced with an end-of-day email from the CEO marked ‘URGENT’, you’d be forgiven for acting on it immediately. Invoice scams are particularly prolific as they play on an employee’s fear of the potential consequences of an unhappy supplier, or partner that could put pause to the organisation’s operations.

Identifying and eliminating CEO fraud

The reason so many phishing attacks come to fruition is that scammers are no longer satisfied with using lookalike email domains, using a lower case ‘L’ for the letter ‘I’ for example. Today, domain impersonation is a simple hack and it makes it impossible for a recipient to identify that the email purporting to come from their CEO is actually a fake.

Contrary to popular belief that email gateway protection, such as spam filters and appliances that weed out emails with malicious content, will protect organizations from domain impersonation, the only sure-fire way to eliminate the threat is with an entirely different (less resource intensive) approach. In the last few years, we’ve seen a wave of action against email impersonation, and global protocols such as DMARC have been widely adopted to tackle email fraud. 

How can Red Sift help?

The Red Sift data analysis platform is purpose-built for the challenges of cybersecurity. Products on the Red Sift platform include OnDMARC, OnINBOX, and OnDOMAIN, SaaS applications that work together to close the net on the phishing problem by blocking outbound phishing attacks, analyzing the security of inbound communications, and providing domain impersonation defense.

Red Sift find out more

PUBLISHED BY

Randal Pinto

17 Mar. 2020

SHARE ARTICLE:

Categories

Recent Posts

VIEW ALL
Cybersecurity

Your guide to the SubdoMailing campaign

Billy McDiarmid

A significant number of well-known organizations have been attacked as part of what’s being called the SubdoMailing (Subdo) campaign that has been going on since at least 2022, research by Guardio Labs has revealed.   The scale of execution of this attack is staggering, and the impact is hugely damaging, but the goal is simple…

Read more
Certificates

A confident deployment guide for TLS and PKI

Ivan Ristic

Our journey to better network transport security has been quite the ride, filled with ups and downs. Back in the ’90s, when SSL and the Netscape browser were just taking off, things were pretty hard. We were dealing with weak encryption, export restrictions on cryptography, and computers that couldn’t keep up. But over the…

Read more
DMARC

Red Sift OnDMARC: The best Agari alternative for DMARC

Francesca Runger-Field

Looking for an alternative to Agari DMARC Protection that helps you safely and efficiently stop unauthorized use of your email-sending domains? You’re in the right place.  Here is your definitive comparison guide for Agari and Red Sift OnDMARC – one of the most popular Agari alternatives on the market.  Red Sift OnDMARC overview Red…

Read more
DMARC

Red Sift OnDMARC: The best Valimail alternative for DMARC

Francesca Runger-Field

Looking for an alternative to Valimail that helps you safely and efficiently stop unauthorized use of your email-sending domains? You’re in the right place.  Here is your definitive comparison guide for Valimail and Red Sift OnDMARC – one of the most popular Valimai alternatives on the market.  Red Sift OnDMARC overview Red Sift OnDMARC…

Read more