Two area government bodies reported significant losses due to fraud recently.
The town of LeClaire lost over $220,000, and Rock Island County, Illinois lost $114,000. Both places fell victim to what the FBI calls the business email compromise. This particular scam is one of the more sophisticated enterprises fraudsters are currently using.
It features crooks, using spoofed or hacked email addresses of actual vendors, clients, or even co-workers, sending invoices or demands for payment, to unsuspecting business or government employees responsible for processing payments. The criminals do their research online and will know names, titles, and positions within the company hierarchy. The emails can mimic recognizable email addresses, and display cut and pasted corporate logos. These emails direct payments to a sham bank account controlled by the criminals. The payments are made through electronic transfers.
But these payments are not always electronic, they are not always directed at the bookkeeping staff, and they don’t always involve hundreds of thousands of dollars. When I read about Rock Island County and LeClaire, it reminded me of an account passed on to me by a colleague in 2020.
My colleague’s daughter, I’ll call her Amber, attended college, and gained a summer internship at a local industrial plant. On Amber’s first day at the plant as an intern, she received an email, appearing to come from the company president, assigning Amber to go to a retailer and purchase 10 $100 gift cards for a company function. The email told Amber to use her own funds to make the purchase, and to expect a reimbursement from the company forthwith.
Amber felt pleased at this recognition and trust from the company president. But like most college students, she lacked $1,000 in her bank account to finance this request. Amber called her mother, who agreed to transfer money into Amber’s account, to get this project rolling.
Amber’s mother met my colleague for lunch soon afterwards, and told him about what Amber accomplished for the company president on her first day on the job. My colleague instantly reacted, realizing this was a scam in progress. He left the restaurant and went directly to the big box retailer, and intercepted Amber at the cash register as she was paying for 10 gift cards. They canceled the sale, with no loss of money. It was a close call.
My colleague’s story offers a couple of lessons:
• Any unexpected email asking for money or a financial favor needs to be verified before you take any action. The hacking and spoofing of emails is everywhere, you must be cautious.
• Any request for payment using gift cards is always a scam. There are never any exceptions. A demand for gift cards is the biggest single clue out there to recognizing scams. Gift cards are for gifts, never for payments.
Relating to the larger issue of business email compromise, this is a type of fraud becoming increasingly common. And the targets can be any kind of business, government, or non-profit. LeClaire would not at first glance seem a likely deep-pocket target. If you handle money for your employer, you are a potential target. The FBI offers some tips to those potential targets:
• Never click on anything in an unsolicited email or text message.
• Never open an attachment from someone you don’t know
• Verify purchase and payment requests in person. Use phone numbers you look up, not something provided by the email.
• Prompts to act urgently or hurriedly should generate exceptional scrutiny.
• Set up two-factor or multi-factor authentication on any account that allows it. Never disable this feature.
• Often scammers target several people in an organization. Talk to your co-workers about strange emails or requests. Warn each other. Check with a supervisor.
• If anyone does fall for a business email compromise, act quickly. Get hold of any banks involved and get them to freeze accounts. Notify law enforcement. Contact the local FBI field office. Don’t delay, or expect someone else to do this, or wait for a call back from legal counsel or some security consultant. My colleague’s story is a great example of how time-sensitive these issues are.
CONTACT SENIORS VS. CRIME
Let me know about scams, fraud, or other crookedness you run across. Most of what I learn, I learn from you. Contact me at Seniors vs. Crime, Clinton County Sheriff’s Office, 242-9211, Ext. 4433, or email me at email@example.com