2 Common Email Spoofing Scams to Avoid: SEC

Fake executives typically used email that, at least superficially, appeared legitimate. "In all of the frauds, the spoofed email directed the companies' finance personnel to work with a purported outside attorney identified in the email," the SEC found. From there, that person directed large wire transfers to be made to fake foreign bank accounts.

Although the SEC noted these weren't sophisticated frauds, they had common elements:

1. Time sensitivity: Spoofed emails were described as time-sensitive, as well as emphasizing the need for secrecy. Also, they sometimes "implied some level of government oversight," at times stating it was done under the supervision of the SEC.
2. Foreign transactions: Spoofed emails also stated that funds were necessary for foreign transactions or acquisitions, therefore directed the wire transfers to foreign banks and beneficiaries. Typically, minimal details were provided.
3. Targeted midlevel personnel: Spoofed emails typically were sent to midlevel personnel who weren't generally weren't responsible for those type of transactions nor usually dealt directly with the executive being spoofed.

The other common scam was emails from fake vendors. The SEC noted this form was more sophisticated than executive emails, largely because they typically  involved "intrusions into the email accounts of issuers' foreign vendors."

After hacking a vendor's account, the scammers typically would access information to gain real purchase orders or invoices, and send them to the company, which would pay the "outstanding invoices" to the perpetrator's foreign account. Because of the long cycle in payments, it typically took longer to notice the problem, the SEC stated.

In its acknowledgement of the threat cyber fraud presents to the capital markets, the agency advised firms that "cybersecurity risk management policies and procedures are key elements of enterprise-wide risk management, including as it relates to compliance with the federal securities laws." Further, "systems of internal accounting controls, by their nature, depend also on personnel that implement, maintain and follow them." In other words, train all staff to be attuned to these scams, be vigilant and not take shortcuts. Even chief financial officers have fallen for these types of scams, so education should happen on all levels, the SEC stated.

In conclusion, the SEC noted that "given the prevalence and continued expansion of these attacks, issuers should be mindful of the risks that cyber-related frauds pose and consider, as appropriate, whether their internal accounting control systems are sufficient to provide reasonable assurances in safeguarding their assets from the risks."

— Related on ThinkAdvisor:

• New Red Flags' Tool Launched to Curb Cyber Risks
• SEC Does Not 'Dictate' Cyber Controls: Cyber Chief Says