4 ms·

Why don't firms flag all email from external domains as "EXTERNAL" (All subjects are prefixed before being transferred to individual email boxes)? We have that

by howeyc 11y ago

Why don't firms flag all email from external domains as "EXTERNAL" (All subjects are prefixed before being transferred to individual email boxes)? We have that where I work, wouldn't that help? That way an email with the CEO's email but with a slightly off email address would show external, where every other email within the company has no such flag.

knodi123 11y ago
First line of email body: Argh! Sorry this got flagged as external. Stupid IT guys. Anyway, we're about to close a major deal that will make us all rich, please wire blah blah blah.
- Zikes 11y ago
  As with most other aspects of this scam, your suggestion would require a certain lack of critical thinking on the accountant's part: how would the sender know that IT had flagged their email as external before the email was sent and flagged?
  - ubernostrum 11y ago
    how would the sender know that IT had flagged their email as external before the email was sent and flagged? The recipients who fall for it don't think about that. They think "oh crap, the big boss needs this done". Critical thinking about and questioning of decisions from higher up is strongly -- one might even say violently -- discouraged in many large organizations.
  - mhurron 11y ago
    > require a certain lack of critical thinking on the accountant's part Which is exactly how these scams work in the first place, so it would probably work just fine.
  - knodi123 11y ago
    "Sorry, I'm travelling, so all my email has been flagged as external lately." I'm not saying that this doesn't require a lapse in critical thinking ability; just that kind of lapse required is a pretty common everyday one, which non-technical people make all the time.
- SilasX 11y ago
  Heh, reminds me of how someone I know trolled Second Life: you can name objects after other people and have them talk, which lets you "put words in their mouth". The devs apparently thought that they could fix this by making objects speak with green text, while human players had white text. So what this guy did, was name an object after someone, wait for them to be away from keyboard, and then say: "Hah! Guys, check this out! I made my text green lol. Anyway, [offensive remarks...]"
rwmurrayVT 11y ago
You just can't stop stupid in this case. It relies entirely on fooling a single person with the ability to initiate the wire. If the company doesn't have that vulnerability then they just move on. Everyone seems so interested in a technical way to stop this, but you can't code your way out of stupid accountants.
- eloff 11y ago
  I think stupid accountants is too harsh here. If you miss that the I in your bosses email address is really a 1 (do you even look at the email address?) How would you know any better? What's stupid is the business processes that allow an accountant that much power over wire transfers without some kind of secondary approval. That's just vulnerable to all kinds of things, like an accountant wiring the money to the Cayman islands and leaving for a country with no extradition treaty.
  - rwmurrayVT 11y ago
    That's not a very good list of countries you would want to reside in. You also stand the risk of having the transfer blocked. The article states that a majority of transactions that get initiated still do not go through. I agree it's not just a stupid accountant, but they need to be responsible when the weight of the job is on their shoulders.
    - eloff 11y ago
      I'm a software engineer, very aware of the insecurity in email, and I could have made that kind of mistake easily. What hope is there for an accountant? No the business process is flat out broken, and its not fair to blame the accountant here. The problem is higher up the responsibility chain.
  - enraged_camel 11y ago
    >>I think stupid accountants is too harsh here. If you miss that the I in your bosses email address is really a 1 (do you even look at the email address?) How would you know any better? Accountants are paid to be extremely detail-oriented. If your accountant can't tell between a 1 and the letter "l", how can you trust him/her to not miss that the amounts he/she is keeping track of and paying don't have extra (or missing) zeroes in them? edit: not sure why this is controversial. Then again I do have high standards when it comes to hiring people into positions that require paying attention to details.
johngalt 11y ago
Any emails that you reply to or forward will get trashed re:[EXTERNAL]fwd:[EXTERNAL] etc... Eventually people will disregard the flags because of the noise. It's a very narrow circumstance where this would actually prevent fraud. You're looking for someone who would normally wire $BIGDOLLAR without verifying it, yet also pay attention to warning flags which are almost always present. You don't win this battle by trying to block all the possible ways in. Instead you create one approved process for handling $BIGDOLLAR transactions.
DenisM 11y ago
How about altering the FROM and CC/BCC email address on incoming email to add [EXTERNAL] to that address? That way subject lines do not accumulate a long number of prefixes.
- kenjackson 11y ago
  This would be useful, not just for fraud, but also just normal business conversations too. Sometimes I've been surprised that the customer is on the email thread (lots of names on the To/CC line). Making it clear about the externals would make this a lot harder to happen.
tmail21 11y ago
You might want to consider TMail21 as an option. User identities cannot be spoofed (like they easily can be with email) AND every TMail from an internal address is marked with an special indicator next to it. This screenshot shows the indicator (blue dot next to "Ron Smith", "Kevin Jones" and "Jill Brady") when the person is from the same company as you. https://tmail21.com/wp-content/uploads/2014/05/tmail-snapshot-new.png?1 https://tmail21.com/wp-content/uploads/2014/05/tmail-snapsho... This would not be the main reason to use TMail21 but is a nice additional benefit. https://tmail21.com/why-tmail/mission-critical-processes/ https://tmail21.com/why-tmail/mission-critical-processes/
DontGiveTwoFlux 11y ago
My university did this for about two weeks. This was a major issue for students because they used it for their primary email address. It was a completely useless flag for us (though maybe not the IT folks who had turned it on) because it was on 9/10 emails. This is an implementation issue though, and perhaps could be more cleverly solved.
TazeTSchnitzel 11y ago
Was thinking the same thing. What if the email client colour-coded emails? Everything from inside the organisation would be surrounded in a green border, everything outside in red.

by howeyc 11y ago

knodi123 11y ago

First line of email body: Argh! Sorry this got flagged as external. Stupid IT guys. Anyway, we're about to close a major deal that will make us all rich, please wire blah blah blah.

Zikes 11y ago
As with most other aspects of this scam, your suggestion would require a certain lack of critical thinking on the accountant's part: how would the sender know that IT had flagged their email as external before the email was sent and flagged?
- ubernostrum 11y ago
  how would the sender know that IT had flagged their email as external before the email was sent and flagged? The recipients who fall for it don't think about that. They think "oh crap, the big boss needs this done". Critical thinking about and questioning of decisions from higher up is strongly -- one might even say violently -- discouraged in many large organizations.
- mhurron 11y ago
  > require a certain lack of critical thinking on the accountant's part Which is exactly how these scams work in the first place, so it would probably work just fine.
- knodi123 11y ago
  "Sorry, I'm travelling, so all my email has been flagged as external lately." I'm not saying that this doesn't require a lapse in critical thinking ability; just that kind of lapse required is a pretty common everyday one, which non-technical people make all the time.
SilasX 11y ago
Heh, reminds me of how someone I know trolled Second Life: you can name objects after other people and have them talk, which lets you "put words in their mouth". The devs apparently thought that they could fix this by making objects speak with green text, while human players had white text. So what this guy did, was name an object after someone, wait for them to be away from keyboard, and then say: "Hah! Guys, check this out! I made my text green lol. Anyway, [offensive remarks...]"

rwmurrayVT 11y ago

You just can't stop stupid in this case. It relies entirely on fooling a single person with the ability to initiate the wire. If the company doesn't have that vulnerability then they just move on. Everyone seems so interested in a technical way to stop this, but you can't code your way out of stupid accountants.

eloff 11y ago
I think stupid accountants is too harsh here. If you miss that the I in your bosses email address is really a 1 (do you even look at the email address?) How would you know any better? What's stupid is the business processes that allow an accountant that much power over wire transfers without some kind of secondary approval. That's just vulnerable to all kinds of things, like an accountant wiring the money to the Cayman islands and leaving for a country with no extradition treaty.
- rwmurrayVT 11y ago
  That's not a very good list of countries you would want to reside in. You also stand the risk of having the transfer blocked. The article states that a majority of transactions that get initiated still do not go through. I agree it's not just a stupid accountant, but they need to be responsible when the weight of the job is on their shoulders.
  - eloff 11y ago
    I'm a software engineer, very aware of the insecurity in email, and I could have made that kind of mistake easily. What hope is there for an accountant? No the business process is flat out broken, and its not fair to blame the accountant here. The problem is higher up the responsibility chain.
- enraged_camel 11y ago
  >>I think stupid accountants is too harsh here. If you miss that the I in your bosses email address is really a 1 (do you even look at the email address?) How would you know any better? Accountants are paid to be extremely detail-oriented. If your accountant can't tell between a 1 and the letter "l", how can you trust him/her to not miss that the amounts he/she is keeping track of and paying don't have extra (or missing) zeroes in them? edit: not sure why this is controversial. Then again I do have high standards when it comes to hiring people into positions that require paying attention to details.

johngalt 11y ago

Any emails that you reply to or forward will get trashed re:[EXTERNAL]fwd:[EXTERNAL] etc... Eventually people will disregard the flags because of the noise. It's a very narrow circumstance where this would actually prevent fraud. You're looking for someone who would normally wire $BIGDOLLAR without verifying it, yet also pay attention to warning flags which are almost always present. You don't win this battle by trying to block all the possible ways in. Instead you create one approved process for handling $BIGDOLLAR transactions.

DenisM 11y ago

How about altering the FROM and CC/BCC email address on incoming email to add [EXTERNAL] to that address? That way subject lines do not accumulate a long number of prefixes.

kenjackson 11y ago
This would be useful, not just for fraud, but also just normal business conversations too. Sometimes I've been surprised that the customer is on the email thread (lots of names on the To/CC line). Making it clear about the externals would make this a lot harder to happen.

tmail21 11y ago

You might want to consider TMail21 as an option. User identities cannot be spoofed (like they easily can be with email) AND every TMail from an internal address is marked with an special indicator next to it. This screenshot shows the indicator (blue dot next to "Ron Smith", "Kevin Jones" and "Jill Brady") when the person is from the same company as you. https://tmail21.com/wp-content/uploads/2014/05/tmail-snapshot-new.png?1 https://tmail21.com/wp-content/uploads/2014/05/tmail-snapsho... This would not be the main reason to use TMail21 but is a nice additional benefit. https://tmail21.com/why-tmail/mission-critical-processes/ https://tmail21.com/why-tmail/mission-critical-processes/

DontGiveTwoFlux 11y ago

My university did this for about two weeks. This was a major issue for students because they used it for their primary email address. It was a completely useless flag for us (though maybe not the IT folks who had turned it on) because it was on 9/10 emails. This is an implementation issue though, and perhaps could be more cleverly solved.

TazeTSchnitzel 11y ago

Was thinking the same thing. What if the email client colour-coded emails? Everything from inside the organisation would be surrounded in a green border, everything outside in red.