What is CEO Fraud?

Image

CEO fraud is a sophisticated email scam that cybercriminals use to trick employees into transferring money or providing them with confidential company information.

Cyber criminals send savvy emails impersonating the company CEO or other company executives and ask employees, typically in HR or accounting, to help them by sending a wire transfer. Often referred to as Business Email Compromise (BEC), this cyber crime uses spoofed or compromised email accounts to trick email recipients into acting.

CEO fraud is a social engineering technique that relies on winning the trust of the email recipient. The cybercriminals behind CEO fraud know that most people don't look at email addresses very closely or notice minor differences in spelling.

These emails use familiar yet urgent language and clarify that the recipient is doing the sender a big favor by helping them out. Cybercriminals prey on the human instinct to trust one another and on the desire to want to help others.

CEO fraud attacks start with phishing, spear phishing, BEC, and executive whaling to impersonate company executives.

These CEO fraud techniques all rely on one key element—people are busy and don't pay full attention to emails, website URLs, text messages, or voicemail details. All it takes is that employees miss a spelling error or a slightly different email address, and the cyber criminal wins.

CEO Fraud Targets

As mentioned earlier, this scam is carried out by spoofing the email address of a company's CEO or other high-ranking executives and then sending fraudulent emails to employees to trick them into transferring money or sensitive information to the attacker.

The most common targets of CEO fraud are the following:

Finance

CEO fraudsters often target finance departments because they can access large sums of money. This means that if a fraudster can convince someone in the finance department to transfer money to them, they stand to make a lot of profit.

They also have a lot of information about the inner workings of a company. This information can be valuable to fraudsters who want to impersonate the CEO or another high-level executive to access sensitive company data.

Executive

CEO fraudsters often target executive departments because they have a lot of authority and responsibility. As a large department with many employees, it's easier for fraudsters to target multiple victims within the department. Executive departments also usually have access to large amounts of money, which makes them an attractive target for fraudsters.

HR

HR department employees have access to a company's entire employee database. This means that scammers can quickly gather the personal information they need to impersonate someone in a position of authority.

Additionally, HR departments handle sensitive information, such as payroll and benefits, as well as contact numbers of employees, which can be used to scam employees out of their hard-earned money and as an opportunity to build rapport and trust with their victims before attempting to defraud them.

IT

IT departments usually have direct access to company financial systems, which scammers can use to transfer funds or make other unauthorized transactions. For this reason, they are often targeted for CEO fraud, typically for accessing sensitive company information that scammers can use to their advantage.

IT departments are also among those sectors with high levels of expertise and knowledge about company operations, making them a valuable resource for scammers looking to exploit vulnerabilities.

CEO fraud attacks have become increasingly common in recent years as criminals have become more sophisticated in their methods of deception. They can also take various forms, making them harder to identify and recognize.

Most CEO fraud attacks occur via email, a form of attack considered as a business email compromise (BEC). However, it’s worth noting that not all BEC is CEO fraud, as there are many other types of BEC.

The most common CEO fraud scams, in order of frequency, are the following:

In gift card scams, the scammer will contact the victim via call, text, email, or social media. They will employ tactics and scripts to get the victim to purchase a gift card from reputable retailers. When the victim makes a purchase, they will hand over the card number and PIN codes, but these aren’t legitimate gift cards and can’t be used.

Gift card scams can be broken down into three main lures:

1. The attacker, posing as CEO, tells their employee they need a gift for a friend or relative’s birthday. A sad story about cancer, COVID-19, or a death in the family usually accompanies this.
2. The attacker, posing as CEO, tells their employee they need gift cards to reward staff members. They usually tell the victim this should be kept confidential to avoid ruining the surprise.
3. The attacker, posing as CEO, tells their employee they need gift cards to give to clients and may even mention a client presentation.

This type of CEO fraud is the most straightforward. The attacker, pretending to be the CEO, informs their employees that they have changed banks and need their direct deposit updated. While 90% of these scams use the CEO title to fool employees, some attackers use mid-level managers or front-line workers as their lure to evade email security.

One notable example of a CEO fraud attack occurred in 2015 when hackers impersonated a German software company SAP CEO, to trick employees into transferring $1.3 million to a bank account controlled by the attackers.

The hackers used email and social engineering techniques to convince the employees that they were legitimate. SAP later admitted that the attack could have been prevented if its employees had been more vigilant.

In another example, hackers impersonated the CEO of an American construction company to trick an employee into sending $28,000 to a fraudulent bank account. The employee became suspicious when the "CEO" asked for the money to be sent via wire transfer rather than using the company's standard payment methods, but by that time, it was too late, and the money had already been sent.

A fake invoice scam happens when a cyber criminal poses as one of the company’s suppliers. They tell a company employee that their payment details have changed and proceed to provide new account details and ask for payment urgently.

This type of CEO fraud primarily takes three forms:

1. A bogus reply chain that appears that the CEO is being pestered by a legitimate company for payment. The CEO will then forward this chain to someone in the finance department and order them to issue the payment immediately.
2. The attackers, posing as the CEO, claim that they owe an outside consultant money and ask an employee to pay the consultant today to avoid the payment being overdue.
3. The attackers, posing as the CEO, claim the company is involved in M&A activity, but to avoid losing the deal, they must wire money immediately. The “CEO” might even request that the transaction be kept secret.

The aging report scam involves two steps. First, the attacker poses as the CEO and asks Accounts Receivable personnel for a copy of the A/R aging report. The cited reason is to do research.

Second, the attacker will pose as the AR clerk and contact all customers on the report. They proceed to ask them for payment, and if they respond, they will receive information that the company has updated their payment instructions. Sometimes, the customer is offered a 10-15% discount for prompt payment.

These examples illustrate how CEO fraud attacks can be challenging to detect, as criminals often use legitimate-looking email addresses and websites to fool victims.

Contact us at 1-866-889-5806 or at [email protected] to learn more about CEO Fraud.

Terranova Security is committed to delivering people-centric training that makes your organization cyber security aware.