Home

About Us

IT Services

Understanding IT

News & Events

Blog

Support

Contact Us

Blog
  • Register

Capstone Works Blog

Capstone Works, Inc. has been serving the Cedar Park area since 2001, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses.

FBI Warns Businesses of Email Scams

The FBI has issued alerts to all businesses about the spread of BEC scams.  One of the fastest growing hazards facing businesses today is the growth of Business Email Compromise or BEC scams.  According to the FBI, these scams have grown by more than 270% since the beginning of last year.  At their last reporting, more than 7,000 businesses have lost more than $1.2 billion in the last 2 years.  At Capstone Works we help you to manage your IT risks.  We are at the forefront of IT risk management; monitoring, assessing and evaluating threats to your network no matter where they may come from.  You can be confident knowing that Capstone Works is in your corner.  While these scams may, at first, seem less impressive than thefts perpetrated by sophisticated malware targeting banks and other large institutions; a BEC attack is, in reality, more vicious.  They are more versatile and can avoid the basic security steps taken by businesses and individuals.  Instead of simply targeting your machines, a BEC scam targets your people!  Criminals are convincing their victims to hand company money right over to them, and they have been very successful in doing so.  According to the FBI, “The scam has been reported in all 50 states and in 79 countries.  Fraudulent transfers have been reported going to 72 countries; however, the majority of the transfers are going to Asian banks located within China and Hong Kong.

BEC scams are being perpetrated in multiple stages.  In the first stage, a traditional email phishing scam is carried out.  Once the criminal has access to an employee’s email account, they will monitor the account for an extended period of time, sometimes up to several months.  During this time, the fraudster is learning the financial processes of the target business.  They are learning if wire transfers are used, who initiates them as well as who typically requests them.  Emails are searched for key terms such as, but not limited to 'invoice', 'deposit', 'president', and 'wire transfer'.  Fraudsters are taking the time to familiarize themselves with the target business’ activities, organizational relationships, interests, as well as travel, or purchasing plans. 

Once the reconnaissance phase of the fraud is completed the second phase of the con is initiated.  This portion comes in two different forms.  The first is known as a CEO Phishing Scam.  Crooks create a domain name that is nearly identical to the company’s and sends a spoof email that appears to be from the CEO or another high-ranking executive.  This email will look totally real and only a very careful reading of the email will give the targeted employee a chance of detecting any sort of problem.  The fraudster impersonating the high-level executive then requests a wire transfer be made.  The target employee believes that their superior has directed them to transfer funds and, being a good employee, the instructions are carried out.  Because they have spent so much time and effort getting ready to perpetrate this fraud, the criminals are able to create an utterly convincing fund request.  Before anyone has realized what has happened company money has disappeared.  

In the second version of this scam, the email of someone within the targeted company responsible for billing and invoicing is taken over and used to send out legitimate appearing invoices instructing that payment be made by wire to a newly designated bank account.  Again, it would take intense scrutiny to notice anything wrong with this phony invoice.  One of the most nefarious aspects of these scams is that they are unlikely to be caught in any spam traps as these are targeted attacks and not mass emails.  These scams continue to grow and evolve as time goes by so it is important to be vigilant.  To protect themselves the FBI has urged businesses to adopt the following processes:

  • Create intrusion detection system rules that flag e-mails with extensions that are similar to company e-mail. For example, legitimate e-mail of abc_company.com would flag fraudulent e-mail of abc-company.com
  • Register all company domains that are slightly different than the actual company domain.
  • Verify changes in vendor payment location by adding additional two-factor authentication such as having a secondary sign- off by company personnel.
  • Confirm requests for transfers of funds. When using phone verification as part of the two-factor authentication, use previously known numbers, not the numbers provided in the e-mail request.
  • Know the habits of your customers, including the details of, reasons behind, and the amounts of payments.
  • Carefully scrutinize all e-mail requests for transfer of funds to determine if the requests are out of the ordinary.

At Capstone Works it is our job to monitor threats to your business.  We are IT experts ready to help defend you against any attack cybercriminals can dish out.  Don’t go it alone, contact the Capstone Works today!

The FBI has issued alerts to all businesses about the spread of BEC scams.  One of the fastest growing hazards facing businesses today is the growth of business email compromise, or BEC scams.  According to the FBI these scams have grown by more than 270% since the beginning of last year.  At their last reporting more than 7,000 businesses have lost more than $1.2 billion in the last 2 years.  At Capstone Works we help you to manage your IT risk.  We are at the forefront of IT risk management; monitoring, assessing, and evaluating threats to your network no matter where they may come from.  You can be confident knowing that Capstone Works is in your corner.  While these scams may at first seem less impressive than thefts perpetrated by sophisticated malware targeting banks and other large institutions; a BEC attack is in reality more vicious.  They are more versatile and can avoid the basic security steps taken by businesses and individuals.  Instead of simply targeting your machines, a BEC scam targets your people!  Criminals are convincing their victims to hand company money right over to them, and they have been very successful in doing so.  According to the FBI, “The scam has been reported in all 50 states and in 79 countries.  Fraudulent transfers have been reported going to 72 countries; however, the majority of the transfers are going to Asian banks located within China and Hong Kong.

BEC scams are being perpetrated in multiple stages.  In the first stage a traditional email phishing scam is carried out.  Once the criminal has access to an employee’s email account, they will monitor the account for an extended period of time, sometimes up to several months.  During this time the fraudster is learning the financial processes of the target business.  They are learning if wire transfers are used, who initiates them as well as who typical requests them.  Emails are searched for key terms such as, but not limited to: invoice, deposit, president, and wire transfer.  Fraudsters are taking the time to familiarize themselves with the target business’ activities, organizational relationships, interests, as well as travel, or purchasing plans.

Once the reconnaissance phase of the fraud is completed the second phase of the con is initiated.  This portion comes in two different forms.  The first is known as a CEO Phishing Scam.  Crooks create a domain name that is nearly identical to the company’s and send a spoof email that appears to be from the CEO or other high ranking executive.  This email will look totally real and only a very careful reading of the email will give the targeted employee a chance of detecting any sort of problem.  The fraudster impersonating the high level executive requests a wire transfer be made.  The target employee believes that their superior has directed them to transfer funds and, being a good employee, the instructions are carried out.  Because they have spent so much time and effort getting ready to perpetrate this fraud, the criminals are able to create an utterly convincing fund request.  Before anyone has realized what has happened company money has disappeared.

In the second version of this scam, the email of someone within the targeted company responsible for billing and invoicing is taken over and used to send out legitimate appearing invoices instructing that payment be made by wire to a newly designated bank account.  Again, it would take intense scrutiny to notice anything wrong with this phony invoice. >One of the most nefarious aspect of these scams is that they are unlikely to be caught in any spam traps as these are targeted attacks and not mass emails.  These scams continue to grow and evolve as time goes by so it is important to be vigilant.  To protect themselves the FBI has urged businesses to adopt the following processes:

  • Create intrusion detection system rules that flag e-mails with extensions that are similar to company e-mail. For example, legitimate e-mail of abc_company.com would flag fraudulent e-mail of abc-company.com.
  • Register all company domains that are slightly different than the actual company domain.
  • Verify changes in vendor payment location by adding additional two-factor authentication such as having a secondary sign- off by company personnel.
  • Confirm requests for transfers of funds. When using phone verification as part of the two-factor authentication, use previously known numbers, not the numbers provided in the e-mail request.
  • Know the habits of your customers, including the details of, reasons behind, and amount of payments.
  • Carefully scrutinize all e-mail requests for transfer of funds to determine if the requests are out of the ordinary.

At Capstone Works it is our job to monitor threats to your business.  We are IT experts ready to help defend you against any attack cybercriminals can dish out.  Don’t go it alone, contact the Capstone Works today!

The Value of Outsourced IT
Take heart, Star Wars fans!
 

Comments

No comments made yet. Be the first to submit a comment
Guest
Already Registered? Login Here
Guest
Friday, March 29, 2024

Captcha Image

Mobile? Grab this Article!

QR-Code dieser Seite

Tag Cloud

Break/fit BDR cybersecurity Innovation Tip of the Week Social Media Common password content Data Recovery Remote Workers cybersecurity tools IoT 365 features Marketing Managed Services Small Business Co-managed IT Microsoft Cloud computing Quick Tips business Managed Service Microsoft Teams Data Privacy Day web application Architect IT Workplace Tips Cloud services Health Saving money Remote Microsoft Office AI Users Efficiency Software Internet Password Broadband high-threat environment IT support Cloud Computing surge protection hackers Workplace Strategy Compliance Outsourced IT Productivity Content Filtering Vendor Current Events File Folder Servers Passwords IT Services media accounts Server Delightful sports teams Communication AWS Backup VoIP Privacy Ransomware Disaster Planning Microsoft Office 365 Saving Money smart devices Workplace Strategies Technology Security Data Managed IT accounts need COVID-19 Gadgets HIPAA password protection application employees download cloud Network Shadow UPS Remote Work Computer January 28 Business Cybersecurity devices Malware comprehensive IT EMR Clutch right time Recovery Two-Factor Authentication best practices business owners AutoCAD Disaster Recovery Best Practices Engineering Hardware Cyberattack Business continuity Email Apple IT Support Business Continuity spam SCAMS managed IT User Tips New Year business continuity Network Security phishing Cloud Communications Mobile Office Hosted Solutions 2FA employees Passwords today Tech Support

Latest News & Events

Capstone Works is proud to announce the launch of our new website at https://www.capstoneworks.com. The goal of the new website is to make it easier for our existing clients to submit and manage support requests, and provide more information about our ser...

Contact Us

Learn more about what Capstone Works can do for your business.

Call Us Today
Call us today
(512) 882-2242

715 Discovery Blvd
Suite 511

Cedar Park, Texas 78613