Think BEC Won’t Cost You Much? How Does $130 Million Sound?
A new lawsuit brings to light the all-too common occurrence of an attack, with this occurring during a business acquisition and costing the buyer more than they bargained for.
During any M&A activity, there is lots of communication around diligence, post-transactions operations changes, contracts, and the financial transaction itself. If there was ever a time when a BEC scam shouldn’t occur, it’s during an acquisition. Such is the case of Tassel Parent, Inc., who was purchasing Graduation Alliance, Inc.
According to a brief on the lawsuit, scammers were able to pose as the shareholders of Graduation Alliance, performing the same action taken with most every computer fraud case – they asked the paying agent to change banking details from Zions Bank in Utah to – get this – a Hong Kong bank with the payment made in the name of HongKong Wemakos Furniture Trading Co.
Um, hello??? Can you say major red flag??
At the time of writing, the scammers were never identified or apprehended.
This is a striking example of how believing that the sender of an email is actually the owner of the email address is simply not enough – particularly anytime there’s money of any kind involved. Whether we’re talking about $130 Million or just $130, scammers of all types rely on people’s established sense of credibility based on an email address, display name, etc.
Anyone in your organization that handles money and communicates via email with others about said money needs to be continually made to take Security Awareness Training to ensure they understand how prolific these kinds of attacks are and how critical it is for them to verify out of band.
Will your users respond to phishing emails?
KnowBe4’s Phishing Reply Test (PRT) is a complimentary IT security tool that makes it easy for you to check to see if key users in your organization will reply to a highly targeted phishing attack without clicking on a link. PRT will give you quick insights into how many users will take the bait so you can take action to train your users and better protect your organization from these fraudulent attacks!
Here’s how it works:
- Immediately start your test with your choice of three phishing email reply scenarios
- Spoof a Sender’s name and email address your users know and trust
- Phishes for user replies and returns the results to you within minutes
- Get a PDF emailed to you within 24 hours with the percentage of users that replied
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-reply-test-partner?partnerid=001a000001lWEoJAAW