Blog

There is a new scam in town that is making the rounds called the “CEO Fraud”. The FBI claims it is responsible for $2.3 billion in losses. Although the impact of the fraud is seen around the world, recently we’ve seen it in Edmonton. The details of the fraud are simple and that is what makes it seem so innocent. In addition to the simplicity of this scam the fraudster relies on something most of us can relate to… being overworked.

How the Scam Works

I’m going to share a scenario based on something that happened to a local Edmonton company we work with. I’m going to walk you through the steps and then share a couple things you can do to avoid getting scammed. Of course the names have been changed.

1. The Bluth Company’s accounting department gets an email from michael@b1uth.com that goes something like this:
   
   ”
   From: Michael Bluth [mailto:michael@b1uth.com]
   Sent: Monday, May 02, 2016 4:53 PM
   To: Katherine Sanchez
   Subject: Bluth Company Invoice

   Katherine, can you take care of an outgoing wire transfer payment for an invoice today?
   
   Email me, I’m too busy now.
   
   Michael Bluth
   President & CEO
   Bluth Company

   [Some footer details about who should get this and so on]”

2. Katherine, the great accounting person that she is responds with something like:
   
   “Hi Michael,
   
   I can help you with that I just need the following details…

   Katherine
   Accounting Enthusiast
   Bluth Company”

3. Now that the fraudsters has someone that can help them they just give Katherine the details for the transfer and they get paid for all of their hard work.

Now that you know how it works see if you can spot the suspicious detail in this email. It’s extremely hard to catch, especially with this font, and for some they don’t even know how to reveal the info needed to detect this scam.

If you look closely you can see the domain that was used was not bluth.com. Take a look at the email address this message was sent from.

Fake email address: michael@b1uth.com
Correct email address: michael@bluth.com

You can see that in the fake email the “L” is actually the number “1”.

[email image pointing out domain]

In some cases even the from email address can be spoofed to show the CEO’s actual email like these clever spammers did here.

So that’s how the fraud works. They rely on that accounting person to be overworked and to reply to their email. Instead of replying to the CEO the accounting person gets the fraudster and then it goes from there.

Two Simple Fixes

Unfortunately, these scams are difficult to block with anti-spam services. The reason being they are unique emails targeted to a specific email addresses making them look legit. Fortunately there are 2 things you can do to spot these fake emails.

Verify the “From” Email Address

Once you know what you’re looking for (a fake “from” email) it’s easy to spot a suspicious email. The challenge some people face though is how to find that info in the header of the email. For outlook 2007, 2010, and 2013 all you have to do is follow these steps:

1. Start Outlook
2. Double-click the message for which you want to view full internet headers.
3. Click “Options” for 2007 and “Tags” for 2010 and 2013.
    
   
    
   The “Message Options” dialog box is displayed. The internet headers are shown in the “Internet headers” field at the bottom of the dialog box.
    
   
    

Two-Factor Authentication

The second method to stop these fraudulent emails is the same way the Edmonton business found out something was off with their email. Their accounting person noticed that the email seemed a bit off and double checked with the CEO over the phone. He knew he didn’t send the email and was able to stop the wire transfer before it was sent.

It is important to note that the accounting person was able to call the CEO. If she would have replied to the email to ask for verification the scammer would have verified the request and she would have most likely sent the wire transfer.

Hopefully these tips will help your email be a bit more safe.