Fraud Prevention Reminder: Beware of Business Email Compromise Scams
Business Email Compromise (“BEC”) scams continue to increase and are causing significant financial losses for businesses of all sizes. This article in last week’s Wall Street Journal is a good example of the issue.
In a typical BEC scheme, a fraudster poses as a trusted individual—such as a business owner, employee, vendor, customer, attorney, banker, or professional advisor—and sends an email requesting a change to payment instructions, bank account information, ACH details, or other financial information. These emails are often convincing and may appear to come from a legitimate email address or a familiar contact. While the methods vary, a common theme is that the fraudster attempts to create a sense of urgency and bypass normal approval procedures.
To help reduce risk, we encourage you to review and reinforce the following internal controls:
- Independently verify any request to change vendor, customer, employee, or other payment information before processing payments.
- Confirm changes using a known telephone number or other trusted contact method—not the contact information provided in the email requesting the change.
- Be cautious of urgent requests involving payments, account changes, or sensitive financial information.
- Require a second review or approval for significant payment changes whenever practical.
- Train employees involved in accounts payable, payroll, treasury, and related functions to recognize these types of fraud attempts; consider period meetings to update and train your team on cyber matters.
Even well-run organizations can be targeted, and a simple verification procedure can often prevent a costly loss.
We encourage business owners and financial personnel to discuss this risk with their teams and confirm that appropriate procedures are in place for handling requests involving payment or banking information. Business Email Compromise Scams are become more prevalent and dangerous.
If you have questions about strengthening controls in this area, please contact your engagement partner or another member of our team.