Cybercriminals don't want to bother with clever hacks to make a quick buck from their victims. And these dozens of scammers aren't just targeting individuals, but also businesses and institutions.
In fact, cybercrime against businesses is on the rise. According to a recent FBI report, losses due to business fraud exceeded $12.5 billion in 2018! Certainly, targeting businesses is a very profitable scheme for scammers.
Now, it appears that scammers have developed a simple but effective way to collect money from companies that use direct deposit to pay their employees. Below are details about the scam and some tips on how to protect your organization.
Fraud in payroll deposit systems is increasing
As with the recent explosion of tax and gift card scams, hackers are now targeting the human resources departments of various companies in hopes of convincing employees to change their payroll bank account information to one under their control.
In one such case, KVC Health Systems, a nonprofit child welfare agency based in Kansas City, receives these types of phishing emails about two or three times a month, CNBC explains.
Similar to Business Email Compromise (BEC) scams, the fake emails appear to be sent from company executives to HR employees. Their request? Change your payroll bank account information that the company uses for direct deposit of pay.
If successful, the hacker could leave the company with thousands of dollars in losses while its employees will of course not be paid on time.
How does this scam work?
Despite its potential for big losses, payroll fraud is not a particularly sophisticated attack. Unlike traditional business email scams, scammers don't even go to the trouble of hacking into your boss's email account. They simply create fake email accounts with free services (like Gmail or Yahoo, for example) in the name of an employee (usually from HR).
With this method, they hope that the targeted employee will be careless enough not to notice the full email address or will view their messages on a phone where only the sender's name is immediately visible in the "From" field.
The messages appear to be short and occasional with a slight sense of urgency, asking the employee to quickly change banking information.
Unlike other email scams, these emails are well-written with few typos and grammatical errors. They often try to prevent the victim from contacting the boss by claiming to be “in a meeting” or have “limited phone coverage.”.
Here are some examples:
"Are you available? Is there something you need to do? I'm going to a meeting and will have limited access to my phone, so just reply to my email.".
“I need to update the information regarding direct deposit of payroll payments. Can we handle this now? Thanks.”
Why is payroll fraud spreading?
Although simple as scams are, they spread because they are easy to create and deploy, usually through automated methods. As I mentioned earlier, the scam does not require the successful hacking of an employee's email account, all that is needed is the creation of a new account in their name.
Then, because the fake emails are short and casual, they don't usually trigger spam and phishing email filters . Furthermore, the scam doesn't raise suspicions, as it doesn't ask for a cash transfer – it just asks for a bank account number change.
This approach has no cost to set up so it can hit more companies with fewer resources. The success rate is lower but they can stay under the radar for a much longer period of time.
How to protect your organization from payroll fraud:
So how do we protect ourselves from these growing cyber scams? Here are some tips:
Be vigilant with emails – Carefully check email addresses, especially those from executives who require financial transactions. A missing character in the address could mean the difference between security and compromise. And as much as possible, don’t use personal emails for company messages.
Improve your company's email filters – Inform your IT department to include keywords from this attack in your email spam filters
Watch out for social engineering scams – Set your social media feed and avoid posting vital details about your work that could expose your organization’s management and human resources employees.
Use two-factor authentication – Consider using two-factor authentication for fund transfers and corporate email accounts. Use known phone numbers for verification and avoid displaying these phone numbers in email correspondence.
