Oregon FBI Tech Tuesday: Avoiding business email compromise schemes

PORTLAND, Ore. (KTVZ) -- This week, the Oregon FBI’s Tech Tuesday segment focuses on building a digital defense when it comes to Business Email Compromise schemes related to COVID-19.  

Fraudsters will take advantage of any opportunity to steal your money, personal information, or both. Right now, they are using the uncertainty surrounding the COVID-19 pandemic to further their efforts. 

Business email compromise (BEC) is a scam that targets anyone who performs legitimate funds transfers. Recently, there has been an increase in BEC frauds targeting municipalities purchasing personal protective equipment or other supplies needed in the fight against COVID-19. 

In a typical BEC scheme, the victim receives an email they believe is from a company they normally conduct business with, but this specific email requests funds be sent to a new account or otherwise alters the standard payment practices. 

Recent examples of BEC attempts include: 

• A financial institution received an email allegedly from the CEO of a company, who had previously scheduled a transfer of $1 million, requesting that the transfer date be moved up and the recipient account be changed “due to the Coronavirus outbreak and quarantine processes and precautions.” The email address used by the fraudsters was almost identical to the CEO’s actual email address with only one letter changed. 
• A bank customer was emailed by someone claiming to be one of the customer’s clients in China. The client requested that all invoice payments be changed to a different bank because their regular bank accounts were inaccessible due to “Corona Virus audits.” The victim sent several wires to the new bank account for a significant loss before discovering the fraud. 

To protect yourself from this fraud, the FBI advises you be on the lookout for the following red flags: 

• Unexplained urgency 
• Last minute changes in wire instructions or recipient account information 
• Last minute changes in established communication platforms or email account addresses 
• Communications only in email and refusal to communicate via telephone or online voice or video platforms 
• Requests for advanced payment of services when not previously required 
• Requests from employees to change direct deposit information 

The FBI also recommends the following tips to help protect yourself and your assets: 

• Be skeptical of last minute changes in wiring instructions or recipient account information. 
• Verify any changes and Information via the contact on file—do not contact the vendor through the number provided in the email. 
• Ensure the URL in emails is associated with the business it claims to be from. 
• Be alert to hyperlinks that may contain misspellings of the actual domain name. 
• Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender’s email address appears to match who it is coming from. 

If you discover you are the victim of a fraudulent incident, immediately contact your financial institution to request a recall of funds and your employer to report irregularities with payroll deposits. As soon as possible, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov or, for BEC and/or email account compromise (EAC) victims, bec.ic3.gov.