CEO Fraud, Phishing and Fake Invoices: How to Stop Them in Your Business

CEO fraud, phishing and changed bank details on invoices all have something in common: they don't need to break into your systems, just convince someone at your business to make a payment or hand over their credentials. That's why the best defence isn't purely technical, but a simple procedure: no new payment and no change of bank account is made without confirming it through a different channel from the one the message came on, usually a call to a number you already had. And because human error can never be fully eliminated, it's worth knowing whether your cyber risk insurance covers these scams, because it's one of the points where policies differ the most.

Three scams, one goal

CEO fraud

Someone impersonates the manager, the owner or a director and writes to whoever handles payments. The message usually has three ingredients: urgency ("it needs to go out today"), confidentiality ("don't mention this to anyone, it's a sensitive matter") and a credible excuse, such as a purchase, an acquisition or a payment to a new supplier. Sometimes the email appears to come from the boss's real address; other times from one that's very similar, with a single letter changed. It's increasingly common for the scam to continue by phone or messaging app, even with imitated voices.

Phishing

This is the email, text message or message that imitates a bank, a courier company, a government body or a cloud software provider, to get you to click a link and enter your credentials. With those credentials, the attacker can get into your email or your online banking. Phishing is often the first step in the other two frauds: they steal access to your email first, and then use it to deceive your customers or your team.

Changed bank details on invoices

This is probably the most damaging for an SME, because it looks routine. A regular supplier (or someone impersonating them) writes to say they've changed bank and that from now on you should pay into a new account. Or you receive an invoice identical to the usual ones, with the same logo and the same amounts, but a different account number. If the attacker is inside the supplier's email, the message even arrives within your usual conversation thread.

A practical example

Take a food distributor in Tenerife with twelve employees. The office manager receives an email from the long-standing packaging supplier, in the same thread they've been discussing orders in for months. It says they've changed bank and attaches a certificate with the new account number. She updates the details and pays the two outstanding invoices. Three weeks later, the supplier calls chasing payment. The supplier's email had been compromised through phishing, and the attacker had been reading their conversations for days.

What would have prevented the problem? A two-minute call to the phone number they already had for the supplier, not the one in the email. What happens now? The business has lost the money, still owes the invoices, and has to check whether its own email has also been compromised. What ends up being covered will depend on what the policy says about fraud through social engineering.

Warning signs

Show this list to anyone on your team who makes payments or receives invoices:

• Unjustified urgency or pressure to skip the usual procedure.
• A request for secrecy: "don't tell anyone", "don't call me, I'm in a meeting".
• A change of bank account communicated only by email or message.
• A new account in another country or in a name other than the supplier's.
• Small differences in the email address, the signature or the tone.
• Links asking you to enter your credentials, even if the message looks like it's from your bank.
• Messages outside normal hours, or just before a long weekend or holiday.

How to prevent it: measures that work in an SME

Procedures

1. Verification through a second channel. Every change of bank account and every unusual payment is confirmed by phone, calling a number that was already on file before the message arrived.
2. Dual authorisation. Set up your banking so that payments above a certain amount need approval from two people.
3. No one skips the procedure, not even on the boss's orders. The manager should say this out loud to the whole team: if they're ever asked to skip it, it isn't really them.
4. Log any changes. Note who changed a bank detail, when, and how it was verified.

Technical measures

• Two-factor authentication on email, banking and cloud software. If your password is stolen, it won't be enough to get in.
• Correct email domain configuration, to make it harder to send messages impersonating your business. Ask whoever handles your IT to set this up.
• External email warnings, flagging messages that come from outside the business even when the name looks internal.
• Up-to-date software on computers and phones used for work.

Training

A short, regular talk with real examples is worth more than a manual nobody reads. Explain the three scams, practise with sample emails, and make it clear that reporting a suspicion is never a mistake, even if it turns out to be a false alarm. The employee who's afraid of looking foolish is the one who ends up paying the fake invoice.

If you've already paid: what to do

1. Call the bank immediately and ask them to try to hold or reverse the transfer. Time is the most important factor.
2. Notify your insurer or your broker through the channel stated in the policy, before doing anything else.
3. File a police report with the Police or the Civil Guard, along with the emails, invoices and proof of payment.
4. Change your email passwords from a clean device and check for any forwarding rules you didn't create.
5. Notify the supplier or customer affected by phone, so they can check their own systems.

You'll find the full step-by-step guide in the first 48 hours after a cyber attack.

What role does insurance play?

Cyber fraud and identity theft are among the standard types of cover in a cyber security policy. But here the small print matters more than anywhere else in the policy, so it's worth asking these questions:

• Does it cover social engineering? That is, transfers an employee makes voluntarily because they've been deceived. This isn't the same as theft through unauthorised access to your banking, and not every policy treats it the same way.
• Up to what limit? This type of fraud often has its own sub-limit, separate from the general limit.
• What conditions does it require? Some policies require you to have followed a verification procedure for the payment to be covered. If you have it in writing and follow it, so much the better.
• What excess applies? This is the part of the amount that you bear in each case.
• What if my customers are deceived in my name? If an attacker uses your email to get a customer to pay into a fake account, they can make a claim against you. That's where third-party liability comes in, another of the standard types of cover.

Remember too that insurance complements, rather than replaces, prevention measures. Having them in place reduces the risk and usually helps you get better terms. You'll find the rest of the cover explained in what a cyber risk insurance policy covers.

Checklist for this week

• Write down the procedure for bank account changes on a sheet and share it with whoever makes payments.
• Turn on dual authorisation in online banking.
• Turn on two-factor authentication on all the business's email accounts.
• Check whether your policy covers social engineering and up to what limit.
• If your team works remotely or uses personal devices, check that you've reported it to your broker, as we explain in cyber security and remote working.

How we can help at Retuerto y Asociados

We review your current policy, or proposals from several insurers, and tell you in writing whether they cover fraud through impersonation, with what sub-limit and under what conditions. If your business's risk goes beyond fraud, we fit it into a complete insurance programme through our business consultancy. Check the cyber security insurance for businesses page or write to us at free quote.