Wire transfers move money fast, and once it's gone, getting it back is close to impossible. That's exactly why cybercriminals love them. Attackers rarely bother breaking through technical defenses.
They go after the people who authorize payments instead, using well-crafted emails and social engineering to steer funds into accounts they own. For finance and IT teams, knowing how these scams operate is where the defense starts.
Wire transfer phishing is a growing threat
Wire transfer phishing is one of the latest email threats to IT security. In a wire transfer phishing attack, hackers use email to impersonate a high level employee, often a CEO or CFO, and convince an employee with financial access to transfer money to a fraudulent account. A wire transfer scam often involves email that appears to be a trusted source but on closer inspection is actually a separate, fraudulent domain name.
1 The FBI estimates that wire transfer fraud, also known as whaling and business email compromise attacks, rose more than 270% in the first eight months of 2015. Business losses have totaled more than $2 billion since January 2015, often generating income for organized crime. With the number of attacks expected to rise, organizations everywhere are seeking more effective email phishing protection . 1
Common types of wire phishing
Attackers vary their tactics based on who they're targeting and what level of financial access that person controls within an organization.
- Executive impersonation exploits internal hierarchy, sending an urgent wire transfer request from a look-alike domain and discouraging the recipient from confirming it by phone.
- Vendor impersonation targets accounts payable teams, posing as a familiar supplier and asking a company to update its bank account information so future payments route to an account the scammer controls.
- Account takeover follows a successful phishing attempt against a real employee, then uses that compromised inbox to request a fraudulent wire transfer from inside the organization's own email domain.
- Real estate wire fraud targets closing transactions, with scammers monitoring pending property sales and sending revised wiring instructions just before a buyer's funds are due.
Each variation relies less on technical intrusion and more on a scammer's ability to blend into an organization's existing communication patterns.
Signs of a wire transfer attack
Most successful scams share behavioral cues that surface well before a money transfer is ever completed.
- Urgency pressures the recipient to act before verifying anything, often citing a confidential deal or an approaching deadline.
- Last-minute account changes involve a request to update bank account information for a vendor or executive who has never asked for a switch before.
- Bypassed verification steps show up when a scammer discourages a phone call or in-person confirmation, citing travel or unavailability as the reason email is the only channel available.
- Domain irregularities show up in the sender's address, with a swapped character or an added word disguising an otherwise familiar company domain.
- Requests for personal information accompany the payment instructions, asking for bank credentials or credit card numbers that a legitimate executive would never request over email.
Any one of these signals is reason enough to pause a wire transfer and verify the request through a separate channel.
How to prevent the threat of wire transfer scams
Reducing exposure to these scams starts with slowing the process down before any funds leave the building. Any employee who can wire money on behalf of the company is a potential target, which makes process discipline as valuable as any security tool.
- Callback verification requires a phone call to a known, previously verified number before wiring money tied to a new or changed account.
- Dual approval splits responsibility for high-value transactions between two employees, so no single person can authorize a fraudulent wire transfer alone.
- Employee training builds information security awareness across finance and accounting staff, helping them recognize a scammer's tactics before a request reaches the approval stage.
- Access controls limit who can view or change bank account information on file for vendors and executives, narrowing the number of employees a scammer could target.
- Transaction monitoring flags unauthorized transactions and unusual transfer patterns before wire transfer payments leave the organization, giving finance teams a window to intervene.
If a fraudulent wire transfer does go through, speed determines the outcome. Contact the receiving bank immediately to request a recall, then file a report with the Federal Trade Commission and the FBI's Internet Crime Complaint Center.
Quick reporting won't guarantee recovery, but it limits financial loss and creates a paper trail that supports any related identity theft or fraud prevention claims down the line.
Protect your team from wire transfer scams with Mimecast
Mimecast Targeted Threat Protection - Impersonation Protect scans all email as it passes through the Mimecast Secure Email Gateway, examining several parts of each message to spot key indicators of a wire transfer phishing attack.
When an email seems suspicious, Mimecast blocks it, quarantines it for review or tags it as suspicious before sending it on to the employee, depending on rules set by IT administrators.
Mimecast provides wire transfer phishing protection for all devices, including corporate desktop and mobile devices as well as employees' personal devices. By scanning inbound emails in real time, Mimecast provides instant and complete protection against these attacks that rely on sophisticated social engineering techniques.
Learn more about defending against wire transfer scams with Mimecast, and about Mimecast solutions to stop ransomware and improve Office 365 security compliance.
