“Bogus Boss” Email Scam

Hello all,

An email scam is causing bosses to “give” instructions to send monetary transactions.

Carole Gratzmuller, boss of a medium-sized French company called Etna Industrie which manufactures industrial equipment for outskirts of Paris, was a victim of this scam dubbed CEO fraud, or “fraude au president” as known in France.

‘Confidential transaction’

“My accountant was called on Friday morning…Someone said: ‘You’re going to get an email from the president, and she’s going to give you instructions to conduct a very confidential transaction and you’re going to have to respond to whatever instructions she gives yo,”she said. 

An email has been sent to the accountant with Ms Gratzmuller’s name in it, saying Etna Industrie was buying a company in Cyprus.

“The email said the accountant was going to get a phone call from a consultant working with a lawyer, who would then give her instructions as to where to transfer the money… Everything happened between 9 and 10 o’clock…The accountant probably got about 10 emails in that time and three or four different phone call,”said Ms Gratzmuller.

The company would have had to shut down if the scam was successful. This phishing fraud is sent out in  way which makes you act quickly.

The accountant had authorised wire transfers totalling €500,000 (£372,000; $542,000) to foreign bank accounts by noon but three of them were held by the bank while one for €100,000 went through.

In a typical scam, somebody poses as a boss and instructs to send money transfers. Or they may pose as the IT service department of the bank and say they want to make a test transfer but processes a real transfer. The fraudsters may also ask for outstanding invoices by pretending to be suppliers.

Employees click on links within phishing emails containing malware which authorises many small payments to the fraudster’s account

Etna Industrie got this money back after the French Courts found the bank in question to be at fault

“It’s like when your house or apartment gets broken into,” says Ms Gratzmuller. “You feel vulnerable. People get into your life and they know things about you and you have no clue, and they take things from you.”

An estimated €465m since 2010 has been lost by 15,000 firms falling victim to the scam, including big names, such as Michelin, KPMG and Nestle. One of the big companies that were victimised was Tyre maker Michelin.  The biggest fraud was for €32m, and a further €830m could have been stolen if more phishing attacks had proved successful, said the French police.

Matthieu Bares, deputy head of their financial crime division, says there are one or two attacks on French companies every day, but that “plenty of victims don’t report the fraud”.

The reason this scam is popular in France could be the French-Israeli man, Gilbert Chikli who defrauded more than 30 banks and companies out of €7.9m during 2005 and 2006 by posing as various company heads.

According to the police, the French-Israeli gangs are predominantly running the fraud, police say, and their ability to impersonate French bosses has seen France bearing the brunt of the onslaught in Europe.

The scam is not just in France. “business email compromise” scams took place in the US and the FBI reckons that $740m has been defrauded from 7000 companies. The real figures could be bigger because not all companies had admitted to have been defrauded.

“We think more than $2bn has been lost to business email scams over the last two years,” says Aaron Higbee, co-founder and chief technology officer of PhishMe, a US security company specialising in educating staff about phishing attacks.

Social engineering is the reason these scams are so effective.

Higbee suggests it because this type of email can more easily bypass spam filters and antivirus security systems. “It doesn’t need attachments carrying malware, it’s just a conversation… It’s very low-tech and a big departure from the large, automated malware attacks we’re used to.”

Can employees identify a phishing email?

Publicly available corporate data is used by fraudsters to make the emails as convincing as possible, finding out who the bosses and senior financial officers are from social networks like LinkedIn, for example. Since staff usually do not question instructions that come from high positions and because these scam emails accompany a sense of urgency, most of these frauds succeed.


Source: Akati

Comments are closed.