6 ms·

Shouldn't companies have controls in set when large amount of money is being requested for transfer? Controls that does not involve using email as final approva

Shouldn't companies have controls in set when large amount of money is being requested for transfer? Controls that does not involve using email as final approval.

cm2187 11y ago
Emails are regularly used for approving large transactions. You can have dedicated approval systems but they are often more of a problem than a solution. When the approver is away you have complex and slow delegation procedures when you are not completely stuck. When people are travelling they can't approve anything while they can on a blackberry. And you need to email people to chase them anyway. These systems are just adding to the corporate bureaucracy. Common sense should be the first line of defense. Even by email, managers should not approve a transaction they know nothing about. And if one approves somethings after having only talked to complete strangers, it's hard to fight raw stupidity. The first think I would have done in this story is fire the accountant.
- cdubzzz 11y ago
  Absolutely agree. > "My accountant was called on Friday morning," she tells the BBC. "Someone said: 'You're going to get an email from the president, and she's going to give you instructions to conduct a very confidential transaction and you're going to have to respond to whatever instructions she gives you'." This should have thrown up so many red flags for anyone. Crazy.
  - rwmurrayVT 11y ago
    It's just a numbers game. There are suckers born every minute. There are an unbelievable number of accountants out there who couldn't put together these obvious signs. A phone call from a stranger and an email from an account that has her name in it... it was probably CEO@imstealingyourmoney.ru
    - Retric 11y ago
      It's easy to fake from address. So, it's going to be CEO@yourconpany.com
      - rwmurrayVT 11y ago
        What major email service would allow that email to pass through into the accountant's inbox with no warning? I guess if you're stupid enough to transfer the money, you're stupid enough to ignore the warnings on the email. This is a serious question just as a FYI.
        Mahn 11y ago
        Why would an email service know that conpany.com is a scam address of company.com? If they were spoofing addresses then it may be detected, but if they are using a valid domain with a random letter changed you are out of luck unless you have common sense and pay a lot of attention.
        joveian 11y ago
        There are many things that can be done to prevent this and likely often are. I've set my mail client to color the subject line of messages differently if the from address is in my addressbook or not. However, I don't know how common it is for mail clients to do things like that by default so there may be many people who don't have any obvious sign that something is wrong. ETA: I think some slight variations on the domain name could also be filtered out completely, but I'd guess it would be hard to catch all of those that it is difficult to visually detect without also filtering legitimate mail.
      - positr0n 11y ago
        Agreed with my sibling post, that email would probably get flagged and dropped as spam before it got to the accountant. I've seen an email like this aimed at the company I work for and it was something like ceo@yourrcompany.com (just one letter was doubled from the real domain).
  - ChrisArgyle 11y ago
    There is a huge cultural/generational component to it. There are some people who you just cannot wire to be suspicious. Either hire the right people or build security into your processes.
- manyxcxi 11y ago
  That's funny, my first thought was to fire the accountant as well. Then I thought about it, who has more experience with these scammers than the accountant that screwed up? I would wager they would never fall for it again if they were any sort of reasonable human being- whereas a new accountant has probably never even heard of this scam and you're vulnerable all over again. What I would do, though, is get my lawyer involved to write up a new contract that would make them liable for every last penny should this happen again.
  - throwaway7767 11y ago
    > What I would do, though, is get my lawyer involved to write up a new contract that would make them liable for every last penny should this happen again. No accountant would work for you with that stipulation, the risk/reward calculation doesn't make sense.
    - gambiting 11y ago
      Not true, my accountant has a contract where she is responsible for any mistakes or miscalculated taxes etc so she has to pay them. She does have a registered accountancy office though and insurance against this sort of thing though so the risk for her is also minimal.
      - arethuza 11y ago
        That doesn't sound like an in-house accountant (i.e. an employee) but that you are engaging an external accountant to work for you - completely different commercial relationships.
        DrJokepu 11y ago
        And they typically have liability insurance anyway. Your contract is not worth the paper it's written on if the accountant is unlikely to be able to ever repay the loss.
  - koliber 11y ago
- leftwich 11y ago
  Emails should not be used to approve six figure cash transactions. An account reconciliation or approval of PTO? Sure. You can easily set up your online banking to require one individual to intiate a wire transfer, and a separate individual to approve the transaction. This is a very basic financial control. My guess is the companies falling victim to this don't have any formal controls in place.
  - rwmurrayVT 11y ago
    It all depends on the size of the company and the stupidity of the accounting/purchasing department. The article describes the fraud ranging from modest to sizable. It's not uncommon for many business to have 50k transactions every week. You don't want to go around getting approval for every transaction every day. It's not uncommon for many businesses to have 300k transactions every month. The business that lost 30m+ I don't understand... It must have been multiple wires over a period of time. They found some vulnerable accountant with the power and just milked them over time.
    - leftwich 11y ago
      Not all transactions are created equal. Six figure cash disbursement transactions should require approval. And any company that has so many six figure cash disbursement transactions that approving them is an administrative burden is the type of company that most needs this kind of control in the first place.
  - cm2187 11y ago
    I have seen emails regularly used to approve 9 and 10 figures transactions. But the approval always knew about the transaction, had talked about it with the relevant manager. And often would double check with the manager they trust that everything is in order.
    - thesis 11y ago
      Can you elaborate at all what kind of billion dollar transactions a manager is approving?
- a3n 11y ago
  > Emails are regularly used for approving large transactions. In a corporation at least you can require an electronic signature, which requires you to provide your network credentials. Of course you have to have implemented this. I have to electronically sign my PTO requests, for example.
  - tmail21 11y ago
    Or you could try Certified Mail from TMail21. https://tmail21.com/why-tmail/mission-critical-processes/ https://tmail21.com/why-tmail/mission-critical-processes/ Mail is certified, identity is non-spoofable, delivery is guaranteed and unlike regular postal certified mail, even the content is certified. In other words it has all the guarantees of normal business transactions like in ERP's like SAP and Oracle.
pbhjpbhj 11y ago
Or at least use signed emails? I was considering it [PGP] last year for company emails but the largest sums I deal with is £100s, if I was controlling £1000s plus based on email transactions I'd think signed emails (in both directions) would be absolutely required.
- DanBC 11y ago
  -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Very few people verify signatures. Most implementations are impossible for most people. Including a signature may increase risk by leading to false sense of security. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 iQA/AWuBP8e2M4NxG4rj7+GnEQKyPQCfaOxVJCSfv1Ej0W1Leo/FNC+zBSsAoNrC vkPIrX6tsLdCT/uG0zGN06fP =vqQX -----END PGP SIGNATURE-----
  - knodi123 11y ago
    Hey, I recognize that gobbledygook. Those random letters and numbers mean I can trust whatever you say, right?
    - wolfgke 11y ago
      No, it means that there is a way with which you can verify whether you can trust or not. Yes, I understand how you meant it. By I really can't understand ordinary people can even come to "your" conclusion. How can people be so stupid (sorry for my harsh wording) not to be able to understand that a digital signature just means that there exists a possibility to check whether the message is authentic (and this has to be done if necessary) instead of being authentic?
      - noxToken 11y ago
        Because its just noise to non-tech people. It's the same reason why email accounts have 2,000 unread inbox messages or 30 notifications at the top of their phone. You get so used to seeing the notification that you begin to ignore it. In this case, you see a string of non-readable text that makes up some weird "signature" at the bottom. The conclusion? "Oh. The signature is there. It's been authentic every other time I checked. Why wouldn't it be authentic on the 101st check?" Humans are the hardest vector to defend in an attack. Never underestimate the laziness of people - even when a simple solution exists to combat the problem at hand.
jimktrains2 11y ago
Wouldn't simply signing mail be enough?

Shouldn't companies have controls in set when large amount of money is being requested for transfer? Controls that does not involve using email as final approval.

cm2187 11y ago

Emails are regularly used for approving large transactions. You can have dedicated approval systems but they are often more of a problem than a solution. When the approver is away you have complex and slow delegation procedures when you are not completely stuck. When people are travelling they can't approve anything while they can on a blackberry. And you need to email people to chase them anyway. These systems are just adding to the corporate bureaucracy. Common sense should be the first line of defense. Even by email, managers should not approve a transaction they know nothing about. And if one approves somethings after having only talked to complete strangers, it's hard to fight raw stupidity. The first think I would have done in this story is fire the accountant.

cdubzzz 11y ago
Absolutely agree. > "My accountant was called on Friday morning," she tells the BBC. "Someone said: 'You're going to get an email from the president, and she's going to give you instructions to conduct a very confidential transaction and you're going to have to respond to whatever instructions she gives you'." This should have thrown up so many red flags for anyone. Crazy.
- rwmurrayVT 11y ago
  It's just a numbers game. There are suckers born every minute. There are an unbelievable number of accountants out there who couldn't put together these obvious signs. A phone call from a stranger and an email from an account that has her name in it... it was probably CEO@imstealingyourmoney.ru
  - Retric 11y ago
    It's easy to fake from address. So, it's going to be CEO@yourconpany.com
    - rwmurrayVT 11y ago
      What major email service would allow that email to pass through into the accountant's inbox with no warning? I guess if you're stupid enough to transfer the money, you're stupid enough to ignore the warnings on the email. This is a serious question just as a FYI.
      - Mahn 11y ago
        Why would an email service know that conpany.com is a scam address of company.com? If they were spoofing addresses then it may be detected, but if they are using a valid domain with a random letter changed you are out of luck unless you have common sense and pay a lot of attention.
        joveian 11y ago
        There are many things that can be done to prevent this and likely often are. I've set my mail client to color the subject line of messages differently if the from address is in my addressbook or not. However, I don't know how common it is for mail clients to do things like that by default so there may be many people who don't have any obvious sign that something is wrong. ETA: I think some slight variations on the domain name could also be filtered out completely, but I'd guess it would be hard to catch all of those that it is difficult to visually detect without also filtering legitimate mail.
    - positr0n 11y ago
      Agreed with my sibling post, that email would probably get flagged and dropped as spam before it got to the accountant. I've seen an email like this aimed at the company I work for and it was something like ceo@yourrcompany.com (just one letter was doubled from the real domain).
- ChrisArgyle 11y ago
  There is a huge cultural/generational component to it. There are some people who you just cannot wire to be suspicious. Either hire the right people or build security into your processes.
manyxcxi 11y ago
That's funny, my first thought was to fire the accountant as well. Then I thought about it, who has more experience with these scammers than the accountant that screwed up? I would wager they would never fall for it again if they were any sort of reasonable human being- whereas a new accountant has probably never even heard of this scam and you're vulnerable all over again. What I would do, though, is get my lawyer involved to write up a new contract that would make them liable for every last penny should this happen again.
- throwaway7767 11y ago
  > What I would do, though, is get my lawyer involved to write up a new contract that would make them liable for every last penny should this happen again. No accountant would work for you with that stipulation, the risk/reward calculation doesn't make sense.
  - gambiting 11y ago
    Not true, my accountant has a contract where she is responsible for any mistakes or miscalculated taxes etc so she has to pay them. She does have a registered accountancy office though and insurance against this sort of thing though so the risk for her is also minimal.
    - arethuza 11y ago
      That doesn't sound like an in-house accountant (i.e. an employee) but that you are engaging an external accountant to work for you - completely different commercial relationships.
      - DrJokepu 11y ago
        And they typically have liability insurance anyway. Your contract is not worth the paper it's written on if the accountant is unlikely to be able to ever repay the loss.
- koliber 11y ago
leftwich 11y ago
Emails should not be used to approve six figure cash transactions. An account reconciliation or approval of PTO? Sure. You can easily set up your online banking to require one individual to intiate a wire transfer, and a separate individual to approve the transaction. This is a very basic financial control. My guess is the companies falling victim to this don't have any formal controls in place.
- rwmurrayVT 11y ago
  It all depends on the size of the company and the stupidity of the accounting/purchasing department. The article describes the fraud ranging from modest to sizable. It's not uncommon for many business to have 50k transactions every week. You don't want to go around getting approval for every transaction every day. It's not uncommon for many businesses to have 300k transactions every month. The business that lost 30m+ I don't understand... It must have been multiple wires over a period of time. They found some vulnerable accountant with the power and just milked them over time.
  - leftwich 11y ago
    Not all transactions are created equal. Six figure cash disbursement transactions should require approval. And any company that has so many six figure cash disbursement transactions that approving them is an administrative burden is the type of company that most needs this kind of control in the first place.
- cm2187 11y ago
  I have seen emails regularly used to approve 9 and 10 figures transactions. But the approval always knew about the transaction, had talked about it with the relevant manager. And often would double check with the manager they trust that everything is in order.
  - thesis 11y ago
    Can you elaborate at all what kind of billion dollar transactions a manager is approving?
a3n 11y ago
> Emails are regularly used for approving large transactions. In a corporation at least you can require an electronic signature, which requires you to provide your network credentials. Of course you have to have implemented this. I have to electronically sign my PTO requests, for example.
- tmail21 11y ago
  Or you could try Certified Mail from TMail21. https://tmail21.com/why-tmail/mission-critical-processes/ https://tmail21.com/why-tmail/mission-critical-processes/ Mail is certified, identity is non-spoofable, delivery is guaranteed and unlike regular postal certified mail, even the content is certified. In other words it has all the guarantees of normal business transactions like in ERP's like SAP and Oracle.

pbhjpbhj 11y ago

Or at least use signed emails? I was considering it [PGP] last year for company emails but the largest sums I deal with is £100s, if I was controlling £1000s plus based on email transactions I'd think signed emails (in both directions) would be absolutely required.

DanBC 11y ago
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Very few people verify signatures. Most implementations are impossible for most people. Including a signature may increase risk by leading to false sense of security. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 iQA/AWuBP8e2M4NxG4rj7+GnEQKyPQCfaOxVJCSfv1Ej0W1Leo/FNC+zBSsAoNrC vkPIrX6tsLdCT/uG0zGN06fP =vqQX -----END PGP SIGNATURE-----
- knodi123 11y ago
  Hey, I recognize that gobbledygook. Those random letters and numbers mean I can trust whatever you say, right?
  - wolfgke 11y ago
    No, it means that there is a way with which you can verify whether you can trust or not. Yes, I understand how you meant it. By I really can't understand ordinary people can even come to "your" conclusion. How can people be so stupid (sorry for my harsh wording) not to be able to understand that a digital signature just means that there exists a possibility to check whether the message is authentic (and this has to be done if necessary) instead of being authentic?
    - noxToken 11y ago
      Because its just noise to non-tech people. It's the same reason why email accounts have 2,000 unread inbox messages or 30 notifications at the top of their phone. You get so used to seeing the notification that you begin to ignore it. In this case, you see a string of non-readable text that makes up some weird "signature" at the bottom. The conclusion? "Oh. The signature is there. It's been authentic every other time I checked. Why wouldn't it be authentic on the 101st check?" Humans are the hardest vector to defend in an attack. Never underestimate the laziness of people - even when a simple solution exists to combat the problem at hand.

jimktrains2 11y ago

Wouldn't simply signing mail be enough?