FBI Warns of $12 Billion Email Scam on Wire Transfers

The best defense, the Bureau says, is to verify all requests for a change in payment type and/or location. BEC/EAC actors "often request that payments originally scheduled for check dispersal be made via wire instead."

Since the bad actors in BEC/EAC scams often use publicly available information to establish their bona fides, the FBI says all parties in a wire transfer should be "wary of any communication that is exclusively e-mail based," and should also "establish a secondary means of communication for verification purposes."

But just making a phone call to establish a party's identification isn't enough. The FBI also suggests that all parties in a wire transfer be "mindful of phone conversations," since victims of the fraud report they have received phone calls from BEC/EAC actors requesting personal information for verification purposes, while "financial institutions report phone calls acknowledging a change in payment type and/or location."

Since some victims report "they were unable to distinguish the fraudulent phone conversation from legitimate conversations," the Bureau suggests another safeguard: "establish code phrases that would only be known to the two legitimate parties."

As for how to respond to an instance of fraud, the FBI strongly suggests that victims file a complaint with its Internet Crime Complaint Center, IC3, which can help victims, financial institutions and law enforcement agencies with recovery efforts.

A Variant of the BCE/EAC

The PSA warns as well that BCE/EAC scams are not limited to wire transfer requests. A variant of the scam, it says, uses compromised legitimate business email accounts to request Personally Identifiable Information (PII) or W-2 forms for employees.

Reports of the growth of that variant scam were included in a February 2018 PSA by the FBI, citing a warning from the IRS's Online Fraud Detection & Prevention (OFDP) office. The IRS described how the scheme works:

Cybercriminals use various spoofing techniques in attempts to contact an employee in the payroll or human resources departments, requesting a list of all employees and copies of their Form W-2. Such techniques include disguising an email to make it appear as if it is from an organization executive or even compromising the email account itself gain legitimacy. This scam is sometimes referred to as business email compromise (BEC) or business email spoofing (BES). They achieve this by spoofing the "From" field and adding a "Reply-To" address or using a free email service account for the email address and spoofing the sender name.