FBI Looks Back At The BEC Scam’s Accelerating Evolution

In the ever-inflating fight against corporate fraud, criminals continue to explore new avenues to steal company funds. Yet technology providers are innovating quickly, too, to continue combatting the threat.

This week, Deutsche Bank announced a partnership with Treasury Intelligence Solutions (TIS) with a focus on mitigating corporate fraud. Together, the firms are developing solutions for corporates operating with multiple banking providers, creating solutions to help streamline their financial management needs. Their first goal is to create a fraud prevention solution combining the bank’s fraud expertise and TIS’s cloud technology.

“Harnessing both company and community data to solve key challenges, such as fraud prevention, together with Deutsche Bank is a big win for our customers,” TIS Co-founder and Chief Product Officer Erol Bozak said in an announcement.

Increasingly, financial institutions and FinTech providers are considered key partners in the fight against financial crimes like the business email compromise (BEC) and supplier fraud. But it’s not the only avenue.

In a recent interview with PYMNTS, Higo CEO Rodolfo Corcuera Meir said Mexico’s embrace of electronic invoice mandates and standardization has allowed the FinTech to integrate into the country’s tax authority portal to verify invoices that need to be paid.

Whether through regulatory initiatives or bank-FinTech collaboration, the fight against corporate fraud wages on. Below, PYMNTS breaks down some of the latest data on the topic, including new stats from the FBI on the BEC scam’s evolution, as well as one case of payroll and accounts payable manipulation.

One individual in Ireland has been arrested as part of law enforcement’s ongoing investigation into invoice redirect fraud, the Independent.ie reported last week. Officers under the Garda National Economic Crime Bureau arrested the individual as part of ongoing Operation SKEIN investigations, which aim to uncover BEC scams and invoice direct frauds, in which cybercriminals pose as legitimate vendors and business partners to have invoices paid into their own bank accounts.

19,369 complaints of BEC scams were received by the FBI in 2020, with U.S. businesses losing a combined $1.8 billion to the fraud, new data from the FBI’s Internet Crime Complaint Center and the agency’s 2020 Internet Crime Report revealed. The losses amount to nearly half of the total of $4.1 billion in losses racked up from all-around internet crime last year. In its report, the FBI highlighted the ongoing evolution and increasing sophistication of the BEC scam. In 2013, the scam largely involved CEO email spoofing. In 2020, however, the attack has spread to target personal accounts, email accounts of legitimate vendors and requests for new types of information including W-2 data. Further, the FBI warned, 2020 saw an increase in BEC scam complaints involving cryptocurrency.

$1.22 million was stolen by a financial controller in Sydney, Australia, Sydney Morning Herald reports revealed. The former employee admitted to the crime, which occurred over an 11-year period at the company Powerbox Australia. The controller manipulated the organization’s payroll system to pay himself extra funds, reports said. The scam also reportedly involved manipulating its accounts payable workflows, securing signatures from one of the company’s owners to approve of invoice payments for vendors that never actually supplied services to the company. Payments were made into the individual’s own bank account, however.

$50 million was sought from ransomware attackers targeting electronics firm Acer, reports Bleeping Computer. The attack group is known as REvil, and gave the company a March 28 deadline to pay the ransom in order to unlock the company’s data. After the date, attackers threatened to double the ransom demand. According to reports, attackers may have exploited the popular professional email service Microsoft Exchange. In a statement, Acer said, “there is an ongoing investigation and for the sake of security, we are unable to comment on details.”