Part of my regular job is to run payroll. Like many companies, we pay our staff by direct deposit. Today, I received what appeared to be an email from an employee asking me to change his banking information. I knew this was a form of business email compromise, known as spear phishing.
Spear phishing is targeted to a specific individual or business, unlike phishing, which typically directs individuals to fake websites. It is easy for fraudsters to find the email addresses they need to attempt this fraud. Our names, roles and employers are listed on various social media platforms and websites. We attend conferences where contact information is shared. We enter draws by putting our business cards in a bowl. A cunning criminal will use these and more to find potential targets.
Some spear phishing emails I receive are impersonating my boss and asking me to do a wire transfer. Other times, the email asks if I am at my desk. Often, they are posing as an employee wanting to change banking information. Others in my office have received emails asking them to pick up gift cards. The common theme in all these emails is not just what we are being asked to do but how we are asked to do it.
How to avoid the hook
Fortunately, there are a few ways to detect a spear phishing email. The easiest way is to check the email address, not the sender’s name. For example, the email address will pop up if you click on the sender’s name in Gmail and Microsoft Mail. In Outlook, when you open an email on the computer, you can see the address it was sent from. If the address does not match the sender’s name, block the address and delete the email. Sometimes, the difference in the email address is as simple as a dot where there usually isn’t one.
Another indication that the email is fraudulent is if the body of the email, or the signature line, is out of nature for the communications you usually receive from that person. If I receive an email from my boss that doesn’t read like the other emails I get from him, it is probably fake. If the email is urgent, that may also be another indicator that the email is fake.
I read somewhere that bank tellers are trained to find counterfeit money by handling real currency. They become so familiar with the real thing that it is easier to tell if it is real or not. It is the same with spear phishing; if something looks off in an email, it is probably fraud. When in doubt, take direct action and talk to the person who appears to be the sender, but do not call them at the number on the email; it might be phony, too.
If you would like to get a weekly email of the latest posts, subscribe below.
Kathleen O’Donoghue, CFE
Leave a Reply