Treasury Secretary Steven Mnuchin is raising red flags ahead of Facebook's proposed cryptocurrency launch.Marketsread more
Some White House officials expect the Cabinet secretary, who has known the president for years, to depart as soon as this summer.Politicsread more
David Marcus, the head of Facebook's digital currency project, said the company expects Libra will drive more advertising revenue for the company.Technologyread more
Epstein is accused of sexually exploiting dozens of underage girls from 2002 through 2005 at his New York and Florida residences. He is a former friend of Presidents Donald...Politicsread more
When you think of Prime Day, you might be thinking about deals on Instant Pots and Amazon Echo devices — not half-off dresses and designer heels. But the market for apparel...Retailread more
Amazon workers in Minnesota and Germany are striking as Prime Day kicks off, in a stand against working conditions and wage practices. The action in Minnesota represents the...Retailread more
The Food and Drug Administration "stands ready" to start reviewing e-cigarettes amid a teen vaping "epidemic," acting Commissioner Ned Sharpless said Monday in a statement.Health and Scienceread more
The Guggenheim CIO says he had been approached by the White House about possibly joining the Federal Reserve.The Fedread more
Joe Lonsdale says his fellow Palantir co-founder Peter Thiel was "courageous" for speaking out against Alphabet's Google.Technologyread more
Wall Street analysts say it is increasingly possible the Trump administration will try using a stronger weapon in the currency wars than just presidential tweets.Market Insiderread more
In his prepared testimony for Tuesday's Senate banking committee hearing, Facebook's David Marcus tells lawmakers that the Libra currency will be secure.Technologyread more
Around two or three times per month, KVC Health Systems, a midsize nonprofit agency for child welfare based in Kansas City, receives phishing emails from criminals with the goal of rerouting an employee's paycheck by direct deposit.
The emails look legitimate at first, as though they come from the CEO, CFO or payroll director.
The scammer is trying to convince human resources personnel to change the bank account and routing information the employee uses to have paychecks direct-deposited. Once routed to the criminal's account, the company is on the hook for replacing the stolen funds and the employee faces the inconvenience of a late paycheck.
It's a new version of wire fraud scams that have devastated businesses in recent years, and a more focused version of a series of payroll fraud crimes that the IRS warned late last year were on the rise. The fraud is growing, experts said, because it easily bypasses many existing technical controls, and the small sums stolen are inoffensive enough that they can be folded into the cost of doing business.
The fake emails defy many existing controls for malicious communications, said Erik Nyberg, director of information technology at KVC. They are usually well written, cordial and lack the misspellings, grammar mistakes and exclamation points that would trigger many popular email filters that search for spam or phishing attempts.
"They might just say, 'I need to update my direct deposit information," said Nyberg. "Or they start with, 'Hey, do you have a second?' and if that target person responds, then they go from there." KVC has had a few near misses, Nyberg said, but has not transferred any paychecks to scammers.
The scam has only emerged in the past month, according to Adrien Gendre, chief solutions architect at email security company Vade Secure.
Many companies "have put processes in place to validate big wire transfers, so now [criminals] want to stay under the radar. It's a new approach, and every day we have more customers reporting it," he said. Gendre said a dozen Vade companies have reported attempts to change direct deposit information.
The scam does not only bypass some email controls. It also bypasses warnings companies may have already issued to their employees about wire fraud, because scammers aren't asking for money or an invoice transfer — they're simply asking to change a bank account number.
The fraudsters typically impersonate the company's higher-value employees, like the CFO or CEO, Nyberg said. The emails are usually brief, polite and lightly urgent, and often ask HR personnel to change the direct deposit information quickly, "before the next paycheck."
Others try to discourage the target from calling, by writing "I am going into a meeting now."
The spoofing doesn't require the criminal to hack into anyone's email account, as it often does with bigger-ticket wire fraud. The scammers generate the fake emails with free services like Gmail -- the scammer simply opens a new Gmail account and fills in the employee's name — which allows them to get around tools meant to detect hacking attempts on employee email, Nyberg explained. Employees may not notice, either because they are working quickly and they don't notice the full email address, or they are working on a mobile device where only the person's name is displayed in the "from" field, he said.
Why would scammers target a nonprofit? Nyberg said he expects that the organization may be attractive in part because of its genial culture: "The nature of our work is helpful, people who are very literally here to help other people. They might also believe that our training isn't as rigorous as a Fortune 500 company," he said.
Despite the relatively low dollar figure associated with this scam -- thousands of dollars compared with hundreds of thousands in a typical wire scam -- Gendre said it's so cheap to execute that he expects it to become more attractive for criminals.
"They have found a way to automate it, which means you can scale it. You may not make $100,000 in one hit, but you may be able to make 20 hits staying in one company, and be able to make your return [on investment]."
To fight the threat, Nyberg said the organization has focused on training people on a simple truth: "The CEO is never going to email you out of the blue and ask you for any deposit changes. And if you have any sliver of a doubt, call the person who is making the request."
Gendre said his company has used "natural language processing," which analyzes the language used in incoming emails to test for "urgency," then flagging those emails as potentially suspicious, especially if they come from a new email address.
Nyberg also said they've asked executives to avoid using their personal emails when sending messages to staff, and the company has also tweaked its email filters to pick up on common hallmarks of the request. Companies that see versions of the scam can also report them to the FBI's IC3 tip line.