CEO Fraud Attacks

These include C-level executives, HR, Accounting and IT staff. Impose more controls and safeguards in these areas including: 

• Review social/public profiles for job duties/descriptions, hierarchical information, out of office detail, or any other sensitive corporate data
• Identify any publicly available email addresses and lists of connections

• Email filtering
• Two-factor authentication
• Automated password and user ID policy enforcement
• Comprehensive access and password management
• Whitelist or blacklist external traffic
• Patch/update of all IT and security systems
• Manage access and permission levels for all employees
• Review existing technical controls and take action to plug any gaps

Every organization should set security policy, review it regularly for gaps, publish it, and make sure employees follow it. It should include such things as:

• Not opening attachments or clicking on links from an unknown source
• Not using USB drives on office computers
• Password management policy (no reusing passwords, no Post-it notes on screens as password reminders, etc.)
• Required security training for all employees
• Review policy on WiFi access. Include contractors and partners as part of this if they need wireless access when on site.

Have a solid wire transfer policy: It should never be possible for a cybercriminal to hijack a corporate email account and convince someone to transfer a large sum immediately. Policy should limit such transactions to relatively small amounts. Anything beyond that threshold must require further authorizations.

Confidential information: When it comes to IP or employee records, policy should determine a chain of approval before such information is released.

IT should have measures in place to:

• Block sites known to spread ransomware
• Keep software patches and virus signature files up-to-date
• Carry out vulnerability scanning and self-assessment using best practice frameworks such as US-CERT or SANS Institute guidelines
• Conduct regular penetration tests on WiFi and other networks to see just how easy it is to gain entry
• Domain Spoof Protection
• Create intrusion detection system rules that flag emails with extensions that are similar to company emails

Recommended company procedures include:

• Make staff study security policy and enforce this 
• Establish how executive leadership is to be informed about cyber-threats and their resolution;
• Establish a schedule for the testing of the cyber-incident response plan
• Register as many as possible company domains that are slightly different than the actual company domain

• Develop a comprehensive cyber incident response plan and test it regularly. Augment the plan based on results.
• Executive leadership must be well informed about the current level of risk and its potential business impact.
• Management must know the volume of cyber incidents detected each week and of what type.
• Understand what information you need to protect: identify the corporate “crown jewels,” how to protect it and who has access.
• Policy should be established as to thresholds and types of incident that require reporting to management
• Cyber-risk MUST be added to existing risk management and governance processes.
• Best practices and industry standards should be gathered up and used to review the existing cybersecurity program.
• Consider obtaining comprehensive cyber security insurance that covers various types of data breaches.

*Note: Normally human error like CEO fraud is NOT covered by cyber security insurance.

No matter how good your prevention steps are, breaches are inevitable. User education plays a big part in minimizing the danger so start here:

• Train users on the basics of cyber and email security
• Train users on how to identify and deal with phishing attacks with new-school security awareness training
• Implement a reporting system for suspected phishing emails such as the Phish Alert Button
• Continue security training regularly to keep it top of mind
• Frequently phish your users to keep awareness up

The best training programs baseline click rates on phishing emails and harness user education to bring that number down. Don't expect a 0% click rate though. Good employee education can reduce phishing success significantly, but there is always someone who doesn’t pay attention, is in a hurry that day, or is simply outsmarted by a very clever cybercriminal.

• Run an initial phishing simulation campaign to establish a baseline percentage of which users are phish-prone.
• Continue simulated phishing attacks at least once a month, but twice is better.
• Once users understand that they will be tested on a regular basis, and that there are repercussions for repeated failures, behavior changes. They develop a less trusting attitude and get much better at spotting a scam email.
• Randomize email content and times they are sent to different employees. When they all get the same thing, one employee spots it and leans out of the cubicle to warn the others. 

Security awareness training should include teaching people to watch out for red flags. Here are the most common things to watch out for:

• Awkward wordings and misspellings
• Slight alterations of company names such as Centriffy instead of Centrify or Tilllage instead of Tillage
• Spoofed email addresses and URLs that are very close to actual corporate addresses, but only slightly different
• Sudden urgency or time-sensitive issues
• Phrases such as “code to admin expenses,” “urgent wire transfer,” “urgent invoice payment” and “new account information” are often used, according to the FBI

• Inform them of the wire transfer in question
• Give them full details of the amount, the account destination and any other pertinent details
• Ask if it is possible to recall the transfer

Speak with their cybersecurity department: Brief them on the incident and ask for their intervention. They can contact their counterparts in the foreign bank to have them prevent the funds from being withdrawn or transferred elsewhere.

Inform them off all the facts related to the incident as soon as possible

In the U.S., the local FBI office is the place to start. The FBI, working with the U.S. Department of Treasury Financial Crimes Enforcement Network may be able to return or freeze the funds. When contacting law enforcement, identify your incident as “BEC”, provide a brief description of the incident, and consider providing the following financial information:

• Originating Name
• Originating Location
• Originating Bank Name
• Originating Bank Account Number
• Recipient Name
• Recipient Bank Name
• Recipient Bank Account Number
• Recipient Bank Location (if available)
• Intermediary Bank Name (if available)
• SWIFT Number
• Date
• Amount of Transaction
• Additional Information (if available) - including “FFC”- For Further Credit; “FAV” – In Favor Of:

Visit the FBI’s Internet Crime Complaint Center (IC3) at www.IC3.gov to file your complaint. Victims should always file a complaint regardless of dollar loss or timing of incident and in addition to the financial information above, provide the following:

• IP and/or email address of fraudulent email
• Date and time of incidents
• Incorrectly formatted invoices or letterheads
• Requests for secrecy or immediate action
• Unusual timing, requests, or wording of the fraudulent phone calls or emails
• Phone numbers of the fraudulent phone calls
• Description of any phone contact to include frequency and timing of calls
• Foreign accents of the callers
• Poorly worded or grammatically incorrect emails
• Reports of any previous email phishing activity

Call an emergency meeting to brief the board and senior management on the incident, steps taken and further actions to be carried out.

Have IT investigate the breach to find the attack vector. If an executive’s email has been hacked, take immediate action to recover control of that account such as changing the password.

But don’t stop there, the likelihood is that the organization has been further infiltrated and other accounts have been compromised. Have them run the gamut of detection technologies to find any and all malware that may be lurking to strike again.

If the organization was breached, it highlights deficiencies in existing technology safeguards. These will prove harder for IT to spot. So bring in outside help to detect any area of intrusion that IT may have missed.

The goal is to eliminate any and all malware that may be buried in existing systems. Cybercriminals are inside. The organization isn’t safe until the attack vector is isolated and all traces of the attack have been eradicated. This is no easy task.

Make sure your cybersecurity insurance covers CEO Fraud: Less than 4% of fraudulently transferred funds are recovered, so it's a good idea to make sure you have the proper insurance in place. While many organizations have taken out cyber-insurance, not all are specifically covered in the event of CEO fraud. This is a grey area in insurance and many refuse to pay up. Despite the presence of a specific cyber insurance policy, the unfortunate fact is that no hardware or software was hacked. It was the human that was hacked instead.

Difference between financial instruments and email fraud: Insurance companies distinguish between these two and that's where gray areas come in. Financial instruments can be defined as monetary contracts between parties such as cash (currency), evidence of an ownership interest in an entity (share), or a contractual right to receive or deliver cash (bond). However, CEO fraud is often categorized as being purely an email fraud and not a financial instrument fraud. In other words, it is being regarded in many cases as a matter of internal negligence or email impersonation as opposed to being a financial instrument matter.

That said, there are dozens of carriers in the market providing up to $300 million in limits. Coverage extensions have developed to include both the third-party liability and first-party cost and expenses associated with a data breach or cyber-attack.

For such an incident to happen, violations of existing policy are likely to be in evidence. Conduct an internal investigation to cover such violations as well as to eliminate any possibility of any collusion with the criminals. Take the appropriate disciplinary action.

When the immediate consequences of the attack have been addressed and full data has been gathered about the attack, draw up a plan that encompasses adding technology and staff training to prevent the same kind of incident from repeating. Be sure to beef up staff awareness training as a vital part of this.