A Case of Diverted Payments: Cybersecurity Lessons

The company had been working with a long-standing customer who they communicated with via email. Invoices, purchase orders and payment confirmations all came through business email accounts, which unfortunately created the perfect opening for a sophisticated cybercriminal group.

The attackers executed the following business email compromise (BEC) scheme.

• The fraudsters gained access to the email account of an Accounts Receivable employee through a phishing email disguised as a legitimate internal IT alert.
• Once inside the account, the attackers monitored email exchanges for weeks, learning the company's processes, payment schedules and even the tone and language used in the emails.
• When it was time to pay an invoice, the attackers struck. They sent an email to the customer mimicking the Accounts Receivable employee with a slight change to the email address, instructing them to send the payment to a new bank account—one controlled by the fraudsters.
• The customer, who was familiar with the employee and the tone of the communication, saw no reason to doubt the request. He sent the payment. Thankfully, his treasury team did a review of the bank account information and determined it was for an offshore account. They were able to stop the payment – but if they hadn’t, that account could have become untraceable within hours.

First of all, you should be asking yourself what causes BEC scams? In this – and many other – cases, it was mainly caused by a combination of two mistakes.

• Lack of email security: The company hadn’t enabled multi-factor authentication (MFA). That means it was easier for attackers to access the email account with stolen credentials.
• Employee awareness gaps: Falling for phishing scams is more common than we’d like to think. But if your employees aren’t properly trained in spotting and avoiding them, they could miss the often-subtle signs of fraud. In this case, the employee didn’t recognize the phishing attempt and clicked the link that was sent to them without doing their due diligence. 

The customer, after being alerted by their treasury team, reached out to the company and informed them that their email account had been spoofed and an attempt was made to change the lockbox information. The incident created a full-blown investigation within the company to determine if there were any other emails that were compromised by the phishing attempts. 

Sometimes, the liability of BEC scams could depend on whether your business was complying with industry standards of cybersecurity. If the company in our example didn’t use multi-factor authentication, some jurisdictions would consider them negligent. Depending on the jurisdiction, you could even be held liable for falling victim to a BEC scam if you ignored obvious red flags, like changes in the sender’s email address or rushed instructions. That’s why making sure everyone in your company has been properly trained in how to spot and prevent fraud is so crucial. 

Your goal should be to avoid disputes over liability if BEC fraud happens to you. To prevent confusion, you should:

• Clearly define fraud and payment-related responsibilities in contracts. Outline exactly who would be responsible in the event of a BEC fraud transfer and what both companies need to be doing to prevent it.
• Mandate secondary verification for any financial or banking changes. While sometimes a company’s payment information changes for perfectly legitimate reasons, the risk of fraud is too high to take changes at face value. Both companies should speak directly to each other in the event a change is necessary, not rely on emails. 
• Maintain robust cybersecurity measures for both parties. Remember, this example started because fraudsters were able to access login information for an employee at one of the companies. If both companies had secure, up-to-date cybersecurity policies, this whole thing might have been avoided before it became a problem.
• Perform customer due diligence before signing new business. Always check that a new company you’re considering working with is legitimate. Many fraudulent businesses can seem perfectly legitimate on the surface – that's why it’s your job to dig deeper.