How would you react if you received an email that appeared to be from a top-level manager in your organization asking you to transfer money into an outside account?If you are considering this situation outside of the context of a typically busy work day, you might tell yourself that you would immediately recognize the request as a scam. Regrettably for the German wire and cable manufacturer, Leoni AG, its finance department employee did not have this insight, and promptly transferred 40 million Euro to the account coordinates listed in the email. The company has thus far been unable to recover the funds and its stock dropped 7 percent after the loss became public knowledge.
"Whaling," in which a hacker poses as a company CEO to dupe lower level employees into taking actions or divulging information, is an increasingly common phishing scam. Other email scams promise recipients that they will receive money if they click on an embedded link or will threaten them with legal action if they don't immediately take some action. Recognizing an email message as suspicious is a function of detecting clues in the message that can range from obvious to hidden. Here's how to spot an email scam before it's too late:
- Does the message include a mismatched URL or a URL with a misleading domain name?Look at the last part of the URL domain name. A suspicious email will frequently use a legitimate corporate name on the left side of a domain, but the right side will be unrecognizable, or will have no relationship to the company's name.
- Does the text of the email include grammar or spelling errors? Email and other electronic communications are often keyed in quickly, resulting in simple errors. If a message is rife with errors or if it reflects weak grammar, look more closely at what the message is requesting. Multiple spelling and grammar errors are evidence of a scam.
- Does the message ask the recipient to click on an embedded link, or to take some other immediate action (such as replying with account information or other personal details)? Email that demands immediate action or that seeks any information should be treated with suspicion.
- Does the email purport to be from a government agency? Scammers have posed as IRS agents in email to threaten recipients with legal action or to promise unclaimed returns if the recipient clicks on a link or responds with personal account information. The IRS and other U.S. government agencies do not use email communications for these purposes.
- Is the content of the email message just too good to be true? A recipient's gut feeling that something about an email message is amiss is often a good sign that the email is suspicious.
Educating employees and issuing precautions will only go so far in an organization. If, in spite of all of these warnings, an email recipient in an organization clicks on an embedded linkor takes some action that is requested in an email, the organization (like Leoni AG) can lose millions of dollars and suffer long-term consequential losses. A cyber protection insurance policy can provide a source of recovery against these losses after all other defenses have failed.
The FBI has announced that more than 22,000 companies have lost an aggregate of more $3 billion as a result of business email compromise scams. This averages to more than $136,000 per company, although many companies have lost substantially more than that amount in degradation of customer loyalty and tarnished reputations. Cyber protection insurance will not stop business email scams, but it will help a targeted company to get back on its feet more quickly after the attack has subsided.