13 ms·

The 'bogus boss' email scam costing firms millions

• howeyc 11y ago
  Why don't firms flag all email from external domains as "EXTERNAL" (All subjects are prefixed before being transferred to individual email boxes)? We have that where I work, wouldn't that help? That way an email with the CEO's email but with a slightly off email address would show external, where every other email within the company has no such flag.
  • knodi123 11y ago
    First line of email body: Argh! Sorry this got flagged as external. Stupid IT guys. Anyway, we're about to close a major deal that will make us all rich, please wire blah blah blah.
    • Zikes 11y ago
      As with most other aspects of this scam, your suggestion would require a certain lack of critical thinking on the accountant's part: how would the sender know that IT had flagged their email as external before the email was sent and flagged?
      • ubernostrum 11y ago
        how would the sender know that IT had flagged their email as external before the email was sent and flagged? The recipients who fall for it don't think about that. They think "oh crap, the big boss needs this done". Critical thinking about and questioning of decisions from higher up is strongly -- one might even say violently -- discouraged in many large organizations.
      • mhurron 11y ago
        > require a certain lack of critical thinking on the accountant's part Which is exactly how these scams work in the first place, so it would probably work just fine.
      • knodi123 11y ago
        "Sorry, I'm travelling, so all my email has been flagged as external lately." I'm not saying that this doesn't require a lapse in critical thinking ability; just that kind of lapse required is a pretty common everyday one, which non-technical people make all the time.
    • SilasX 11y ago
      Heh, reminds me of how someone I know trolled Second Life: you can name objects after other people and have them talk, which lets you "put words in their mouth". The devs apparently thought that they could fix this by making objects speak with green text, while human players had white text. So what this guy did, was name an object after someone, wait for them to be away from keyboard, and then say: "Hah! Guys, check this out! I made my text green lol. Anyway, [offensive remarks...]"
  • rwmurrayVT 11y ago
    You just can't stop stupid in this case. It relies entirely on fooling a single person with the ability to initiate the wire. If the company doesn't have that vulnerability then they just move on. Everyone seems so interested in a technical way to stop this, but you can't code your way out of stupid accountants.
    • eloff 11y ago
      I think stupid accountants is too harsh here. If you miss that the I in your bosses email address is really a 1 (do you even look at the email address?) How would you know any better? What's stupid is the business processes that allow an accountant that much power over wire transfers without some kind of secondary approval. That's just vulnerable to all kinds of things, like an accountant wiring the money to the Cayman islands and leaving for a country with no extradition treaty.
      • rwmurrayVT 11y ago
        That's not a very good list of countries you would want to reside in. You also stand the risk of having the transfer blocked. The article states that a majority of transactions that get initiated still do not go through. I agree it's not just a stupid accountant, but they need to be responsible when the weight of the job is on their shoulders.
        • eloff 11y ago
          I'm a software engineer, very aware of the insecurity in email, and I could have made that kind of mistake easily. What hope is there for an accountant? No the business process is flat out broken, and its not fair to blame the accountant here. The problem is higher up the responsibility chain.
      • enraged_camel 11y ago
        >>I think stupid accountants is too harsh here. If you miss that the I in your bosses email address is really a 1 (do you even look at the email address?) How would you know any better? Accountants are paid to be extremely detail-oriented. If your accountant can't tell between a 1 and the letter "l", how can you trust him/her to not miss that the amounts he/she is keeping track of and paying don't have extra (or missing) zeroes in them? edit: not sure why this is controversial. Then again I do have high standards when it comes to hiring people into positions that require paying attention to details.
  • johngalt 11y ago
    Any emails that you reply to or forward will get trashed re:[EXTERNAL]fwd:[EXTERNAL] etc... Eventually people will disregard the flags because of the noise. It's a very narrow circumstance where this would actually prevent fraud. You're looking for someone who would normally wire $BIGDOLLAR without verifying it, yet also pay attention to warning flags which are almost always present. You don't win this battle by trying to block all the possible ways in. Instead you create one approved process for handling $BIGDOLLAR transactions.
  • DenisM 11y ago
    How about altering the FROM and CC/BCC email address on incoming email to add [EXTERNAL] to that address? That way subject lines do not accumulate a long number of prefixes.
    • kenjackson 11y ago
      This would be useful, not just for fraud, but also just normal business conversations too. Sometimes I've been surprised that the customer is on the email thread (lots of names on the To/CC line). Making it clear about the externals would make this a lot harder to happen.
  • tmail21 11y ago
    You might want to consider TMail21 as an option. User identities cannot be spoofed (like they easily can be with email) AND every TMail from an internal address is marked with an special indicator next to it. This screenshot shows the indicator (blue dot next to "Ron Smith", "Kevin Jones" and "Jill Brady") when the person is from the same company as you. https://tmail21.com/wp-content/uploads/2014/05/tmail-snapshot-new.png?1 https://tmail21.com/wp-content/uploads/2014/05/tmail-snapsho... This would not be the main reason to use TMail21 but is a nice additional benefit. https://tmail21.com/why-tmail/mission-critical-processes/ https://tmail21.com/why-tmail/mission-critical-processes/
  • DontGiveTwoFlux 11y ago
    My university did this for about two weeks. This was a major issue for students because they used it for their primary email address. It was a completely useless flag for us (though maybe not the IT folks who had turned it on) because it was on 9/10 emails. This is an implementation issue though, and perhaps could be more cleverly solved.
  • TazeTSchnitzel 11y ago
    Was thinking the same thing. What if the email client colour-coded emails? Everything from inside the organisation would be surrounded in a green border, everything outside in red.
• sschueller 11y ago
  Aren't there transfer limits requiring physical sign off by the CEO to prevent these kind of things?
  • rwmurrayVT 11y ago
    I'm sure a large portion of companies do have these controls. But it's just a numbers game. Honestly, I'm tempted to say a decently thought out attempt on my own employer would likely be successful if the amount was reasonable for our average purchase price.
  • HillRat 11y ago
    A surprisingly large number of SMBs in my experience don't have capital transfer controls, especially when the CEO is used to doing financial transfers on the fly. I can think of half a dozen reasonably-sized businesses I've worked with who would be vulnerable to this scam, even with their internal accountants -- a fraudster could call them up, tell them that they needed to draft some five-figure amount because the company got behind on its 401K matches or insurance, and the accountant would think, "Yeah, that sounds about right." And these are the companies who can least afford to get scammed -- they're low-margin companies moving funds around all the time because they're scrambling to keep the balls in the air, so a good-sized fraudulent transfer would cripple them. I'm more surprised that the convicted fraudster is living in an Ashdod mansion off the beach, and evidently the current Israeli government isn't interested in repatriating him to France to serve his time. I mean, I know there's no bilateral extradition treaty in place, but the son of a bitch brags about what he did -- he doesn't even pretend to deny it!
    • mattmanser 11y ago
      A lot of this is because the move from 10 to 50 employees can happen in 2 years, is incredibly hectic in itself, chain of command can be a bit confusing and no-one even thinks something like this might happen. And because the growth is organic rather than the artificial growth of a massive VC cash injection, most companies don't know what they don't know.
• vermontdevil 11y ago
  Shouldn't companies have controls in set when large amount of money is being requested for transfer? Controls that does not involve using email as final approval.
  • cm2187 11y ago
    Emails are regularly used for approving large transactions. You can have dedicated approval systems but they are often more of a problem than a solution. When the approver is away you have complex and slow delegation procedures when you are not completely stuck. When people are travelling they can't approve anything while they can on a blackberry. And you need to email people to chase them anyway. These systems are just adding to the corporate bureaucracy. Common sense should be the first line of defense. Even by email, managers should not approve a transaction they know nothing about. And if one approves somethings after having only talked to complete strangers, it's hard to fight raw stupidity. The first think I would have done in this story is fire the accountant.
    • cdubzzz 11y ago
      Absolutely agree. > "My accountant was called on Friday morning," she tells the BBC. "Someone said: 'You're going to get an email from the president, and she's going to give you instructions to conduct a very confidential transaction and you're going to have to respond to whatever instructions she gives you'." This should have thrown up so many red flags for anyone. Crazy.
      • rwmurrayVT 11y ago
        It's just a numbers game. There are suckers born every minute. There are an unbelievable number of accountants out there who couldn't put together these obvious signs. A phone call from a stranger and an email from an account that has her name in it... it was probably CEO@imstealingyourmoney.ru
        • Retric 11y ago
          It's easy to fake from address. So, it's going to be CEO@yourconpany.com
• rubberstamp 11y ago
  I can't believe 15000 firms have fallen into that trap. Shouldn't you first verify who you are paying to. Accountant should've verified with her by calling her. No transaction is that urgent that it has to be done in an hour.
  • peterjancelis 11y ago
    Ha I was thinking of your app when I read this.
  • rwmurrayVT 11y ago
    It appears the CEO was purportedly on international calling. Perhaps this wasn't an immediately available option.
  • deleted 11y ago
    [deleted]
• FussyZeus 11y ago
  Is this really that shocking? Just seems like the natural evolution of business scams, we still get the people trying to sell us warranties on our company vehicles and trying to sell us toner for printers we barely use (paperless office woo!). You know the part that makes me laugh is if these people put their ingenuity into doing something useful for society, they wouldn't need to be stealing from everyone all the bloody time.
• hyperpape 11y ago
  So it seems like this relies on sending email that purports to be from your boss. Aside from the other problems with procedure (like, why don't you get your boss on the phone?), isn't DKIM supposed to be a partial solution to these kind of fraudulent emails?
• e40 11y ago
  My accountant got one of these. We called the bank that we were to transfer to the funds to and talked to their fraud department. They wouldn't/couldn't do much, but the account was clearly in control of the criminal. Too bad no one cares, because they leave a trail and could easily be caught.
  • deleted 11y ago
    [deleted]
  • rwmurrayVT 11y ago
    Unfortunately, they absolutely can't do anything about it. There are an endless number of scenarios in which an attempted reverse transfer could be fraudulent. If you suffered a loss they want your bank to worry about it. As for tracking them, it's not as simple as you probably believe. Opening a business checking account or personal checking account anonymously is a lot easier than you believe. Withdrawing 10-50k is also not as difficult as you might believe. Moving hundreds of thousands to millions might be present an issue. You might be able to get some money back if it's that high dollar, but if you sent it to a shady country you're screwed.
• morgante 11y ago
  I don't understand how you would ever think it's reasonable to make a large transfer based on just a strange email from your boss. At least get them on the phone.
  • laumars 11y ago
    Some CEOs run a company that way though. They will be blunt and impatient; often sending e-mails like "just get it sorted". I can completely understand how some might not even question the e-mails as being out of character.
    • r00fus 11y ago
      As another commenter said above - these are the ripest targets for such bogus boss scams.
• ndespres 11y ago
  I'm an IT consultant in NYC, and no fewer than 5 of my clients have been targeted by such scams. Information on the structure of their company is gathered from their website and an email will be fabricated appearing to be a conversation between company president, controller, CFO, etc all with their real names and email addresses, sent to a company accountant or something requesting a wire transfer. The final email will be sent from a very similar email domain: the scammers register a domain with a simple letter/number substitution that is VERY difficult to visually detect if you aren't looking. Many were registered with VistaPrint, who offer free registration of domains on a trial plan, or something. You can see a list of their recently-registered domains here http://vistaprinta.tk/ http://vistaprinta.tk/, if you scan through it you'll see some misspellings and l/1 switcheroos. (I spoke with someone at Vistaprint who indicated that they are actively working on this problem, and they have taken quick action when requested). When my clients ask me to take a technology approach on these matters, I encourage them to treat it as a process issue instead. Having adequate controls for issues like this (phone call required, second approver for large wire transfers, etc) is better than any futile spam-blocking action we could take.
  • DenisM 11y ago
    At Microsoft, when an email has an internal sender address it will not get delivered unless that email did in fact come from an internal Exchange server. In 1998 I was able to use SMTP to send an email "from Bill Gates" (only sent it to myself for my own personal amusement), but the trick stopped working later.
    • bostonpete 11y ago
      That doesn't seem like it would guard against an e-mail sent from "a very similar email domain" like ndespres described.
      • DenisM 11y ago
        Yes, but I could always double-click on the mail address in Outlook and see the internal address book entry if the email is spelt correctly. When verification is easy, people do more of it.
• pbhjpbhj 11y ago
  In the OP wouldn't the accountant be liable. They performed the transaction without verifying the authority of those requesting it. OT: >"Her firm, which which employs 50 people" // Surely the BBC's story editing software has a spell-checker that looks for errant word duplication?
  • david-given 11y ago
    You'd think that that would be easy to detect with no false positives.
    • branchless 11y ago
      The faith that he had had, had had an affect on his life. with thanks to s/o
      • pilsetnieks 11y ago
        It depends upon what the meaning of the word is is
      • pbhjpbhj 11y ago
        It has to be an exceedingly naive filter if it won't catch "which which" as being highly likely to be an error and "had had" as being relatively common. False positives are of course possible [it's always possible that you're writing about writing errors], we're talking about an aid though - I'd imagine a company like the BBC would use an in-house spell-checker of some form to check that documents match the style guide and that finding unlikely word duplications could easily be included. How often is "the the" or "which which" actually intended, less than 1% of occurrences? Buffalo.
        • branchless 11y ago
          I dropped my kid off at school. Bison.
    • pbhjpbhj 11y ago
• soared 11y ago
  If you've done any serious gaming, especially an MMORPG, you've seen this scam a million times. Register an account with a name something like "Mod Steve" or "Blizzzard Rep" and just private message every rich player you see. Claim to be a service rep, say you need to verify their password for security or whatever, and 5% of the time they'll give it to you. I made a lot of free money on runescape doing this back in elementary school. "Jagex Modz 1"
  • JoshTriplett 11y ago
    Leaving aside the infamous laws against "unauthorized access", if you pulled that scam on any gaming platform that had a real-money market, that could easily be interpreted as theft.
    • mschuster91 11y ago
      > Leaving aside the infamous laws against "unauthorized access" Why should that be unauthorized? Unless it's written in the T&C that you must not use a pseudonym which impersonates a company official, he had used the system in a legitimate way and did not exploit bugs or bypassed access controls.
      • rubidium 11y ago
        google "criminal impersonation" for your answer. Doesn't need to be in T&C for the law to apply (most countries that is).
      • mikecaputo 11y ago
        I believe he is referring to logging in as the other to transfer their goods once they have mistakenly given you the password. That's the unauthorized access, not naming yourself something that is similar to a moderators name.
        • JoshTriplett 11y ago
          Exactly. Phishing someone's password and not using it might be a T&C violation, but shouldn't necessarily be illegal (you might, for instance, be doing a study on user gullibility, or be part of a red team checking the security policies of a partner or supplier). Actually using that password, on the other hand...
• wolfgke 11y ago
  That's why firms should use email signatures for any email that is supposed to be assumed to be authentic. In other words: The boss should have to sign this kind of email with his private key. The public key distribution problem is solved rather easily in firms (i.e. this is job of the local admin) opposed to the open internet. So not using well-known best pratices (email signatures created with private key) is simply stupidity and these firms get what they deserve.
• mny1 11y ago
  Isn't this potentially a great idea for a start-up? A SaaS solution which simplifies / streamlines companies’ internal (and potentially external) approval processes.. I am no expert in this area but a quick google search shows only solutions which look cumbersome and overly complex (or come as part of large and probably fairly inflexible CRMs). I would probably target SMEs first, ie the sort of companies mentioned in the article. Anyway, if anyone thinks there may be an opportunity here and wants to talk about this a bit more, drop me an email (address in my profile).
  • tmail21 11y ago
    Hi, TMail21 is a SaaS solution that can support many types of processes. It can support both internal as well as external processes and in particular it can also support approval processes. Additionally it supports characteristics like Certified Mail, guaranteed delivery, non-spoofable identities, non-repudiable audit trails etc. which make it perfect for this kind of problem. You can learn more at https://tmail21.com https://tmail21.com. This next link specifically talks about characteristics related to security, identity, non-repudiability, certified mail etc. https://tmail21.com/why-tmail/mission-critical-processes/ https://tmail21.com/why-tmail/mission-critical-processes/
    • dang 11y ago
      This account's comments are promotional to the point of being spam. Please stop posting them to HN. Discussions here are supposed to be conversations, not commercials.
      • tmail21 11y ago
        I apologize if they came across as excessively commercial. I thought they were relevant to the discussion at hand. I will be more careful in the future.
• ommunist 11y ago
  If there is a culture of "follow my order or get fired" in your company -- prepare to be hit.
• Zikes 11y ago
  It sounds like there's a real market for a simple 2FA system for approving large/urgent transactions like this. Something like Google Auth, but with a 30 minute window as opposed to seconds, to keep email viable. Alternatively, the window could be made smaller if the accountant's 2FA client kept a short history of valid codes and timestamps. Then again, without a systematic lockout (i.e. putting this restriction into the bank account itself) then the 2FA system could probably be socially engineered away just like any other safeguard.
  • Nutmog 11y ago
    I know someone who's dad lost tens of thousands through a text message scam. They asked for his password, and his hardware 2FA device code, and the code sent back to him as text message. He gave all of that to an anonymous person through text messages!
• bluedino 11y ago
  Our CFO received an email like this, it appeared to be from the owner of our company. They even used owner.name@ourdomain.com as the 'from' address. We don't use that naming scheme for email accounts, and it was actually using a Yahoo address as the 'reply-to' address. Subject: Transfer Hi John, Hope your day is going on well, I need you to process a Transfer payment swiftly,let me know what details would be needed, to get it done as soon as possible Kind Regards, Jane Doe Very weird, not sure if a bot puts these together or if there's human involvement.
  • danbower 11y ago
    > Very weird, not sure if a bot puts these together or if there's human involvement. It'd be easy enough to source a list of company names and owners of the companies then generate possible domains and possible email addresses for the owners but you ultimately need to know who should receive the email. This probably involves a human digging around on LinkedIn. I have no idea what's it like to scrape LinkedIn but presumably they make it difficult. The difference between using the correct email address for the CFO but incorrect one for the owner suggests it's a bit of both.
• deleted 11y ago
  [deleted]
• DenisM 11y ago
  Ideally email addresses would just have different colors - internal email green, external red (as verified domain spelling and by SPF/DKIM). That would also help immensely with accidental leaks of internal discussions, which is something I have to constantly watch out for with gmail (google apps).
  • scoot 11y ago
    Mail in iOS supports this (for spelling at least). Settings > Mail > Mark Addresses
• pdkl95 11y ago
  All this talk about email forgery... so why isn't all all of this email authenticated with GPG? This type of authentication is a solved problem. Yes, in the general case PKI is a broken and web-of-trust is hard to bootstrap, but protection against scams like this don't need to solve the general case. Distributing keys internally isn't hard. Even some communication external to the organization should be easily authenticated with pubkey crypto - it's not more difficult than the business contracts everybody already uses regularly. Why is everybody trying to solve this with email headers or fallible human judgment?
  • leephillips 11y ago
    The usual: it's a social problem, not a technological problem. Cryptography is the solution to almost everything that people complain about with email, but, there you go.
  • chc 11y ago
    The same reason basically all other email is not authenticated with GPG: it is a usability nightmare. Even many technically apt people find it too much of a headache. It has no chance of universal adoption in the C suite, and without that kind of adoption, it can't help to prevent things like this.
    • pdkl95 11y ago
      What is hard about authentication? This was trivial along time ago with mutt and it was still trivial in recent years with thunderbird+enigmail. If your complain is that your favorite email client doesn't support pubkey authentication, complain to the vendor. The only thing that should even be relevant re: usability is the need to occasionally enter a password. This is even minimized with gpg-agent (or similar), which we can assume is something that would be setup by IT anyway along with everything else related to email. > C suite Then educate them about the need. Even better, educate the lawyers about why authorizing large purchases (i.e. the type of scam currently being discussed) without proper authentication is an unacceptable risk. > it can't help to prevent things like this While you cannot fix a stupid CxO, the problem of deciding if a particular email claiming to to be from that CxO authorizing a purchase order is actually from that CxO is easy. Remember, we only need to solve the internal case, where it is easy to setup PKI. I believe there are even several solutions already available[1] for directory services and key management. Run some sort of local directory service and a local CA and a decent email client should make authentically completely transparent for internal emails.
• elchief 11y ago
  Some poor lady at work got "fired" by our "ceo". She cried. She got unfired. Not sure why a scammer would try that exactly...
  • eli 11y ago
    That sounds more like a co-worker or someone else with a grudge, not a scam
• jqm 11y ago
  No extradition treaty between France and Israel? That seems kind of strange.