4 ms·

You just can't stop stupid in this case. It relies entirely on fooling a single person with the ability to initiate the wire. If the company doesn't have that v

You just can't stop stupid in this case. It relies entirely on fooling a single person with the ability to initiate the wire. If the company doesn't have that vulnerability then they just move on. Everyone seems so interested in a technical way to stop this, but you can't code your way out of stupid accountants.

eloff 11y ago
I think stupid accountants is too harsh here. If you miss that the I in your bosses email address is really a 1 (do you even look at the email address?) How would you know any better? What's stupid is the business processes that allow an accountant that much power over wire transfers without some kind of secondary approval. That's just vulnerable to all kinds of things, like an accountant wiring the money to the Cayman islands and leaving for a country with no extradition treaty.
- rwmurrayVT 11y ago
  That's not a very good list of countries you would want to reside in. You also stand the risk of having the transfer blocked. The article states that a majority of transactions that get initiated still do not go through. I agree it's not just a stupid accountant, but they need to be responsible when the weight of the job is on their shoulders.
  - eloff 11y ago
    I'm a software engineer, very aware of the insecurity in email, and I could have made that kind of mistake easily. What hope is there for an accountant? No the business process is flat out broken, and its not fair to blame the accountant here. The problem is higher up the responsibility chain.
- enraged_camel 11y ago
  >>I think stupid accountants is too harsh here. If you miss that the I in your bosses email address is really a 1 (do you even look at the email address?) How would you know any better? Accountants are paid to be extremely detail-oriented. If your accountant can't tell between a 1 and the letter "l", how can you trust him/her to not miss that the amounts he/she is keeping track of and paying don't have extra (or missing) zeroes in them? edit: not sure why this is controversial. Then again I do have high standards when it comes to hiring people into positions that require paying attention to details.
  - HeyLaughingBoy 11y ago
    Probably because the detail you're hiring them for (looking at financials) is not the detail this thread is about: looking at email addresses. The reality is people are not robots and tend to focus on only one thing at a time. That won't change.

eloff 11y ago

I think stupid accountants is too harsh here. If you miss that the I in your bosses email address is really a 1 (do you even look at the email address?) How would you know any better? What's stupid is the business processes that allow an accountant that much power over wire transfers without some kind of secondary approval. That's just vulnerable to all kinds of things, like an accountant wiring the money to the Cayman islands and leaving for a country with no extradition treaty.

rwmurrayVT 11y ago
That's not a very good list of countries you would want to reside in. You also stand the risk of having the transfer blocked. The article states that a majority of transactions that get initiated still do not go through. I agree it's not just a stupid accountant, but they need to be responsible when the weight of the job is on their shoulders.
- eloff 11y ago
  I'm a software engineer, very aware of the insecurity in email, and I could have made that kind of mistake easily. What hope is there for an accountant? No the business process is flat out broken, and its not fair to blame the accountant here. The problem is higher up the responsibility chain.
enraged_camel 11y ago
>>I think stupid accountants is too harsh here. If you miss that the I in your bosses email address is really a 1 (do you even look at the email address?) How would you know any better? Accountants are paid to be extremely detail-oriented. If your accountant can't tell between a 1 and the letter "l", how can you trust him/her to not miss that the amounts he/she is keeping track of and paying don't have extra (or missing) zeroes in them? edit: not sure why this is controversial. Then again I do have high standards when it comes to hiring people into positions that require paying attention to details.
- HeyLaughingBoy 11y ago
  Probably because the detail you're hiring them for (looking at financials) is not the detail this thread is about: looking at email addresses. The reality is people are not robots and tend to focus on only one thing at a time. That won't change.