A new wire fraud scam targets your direct deposit info and sends your paycheck to a criminal's account

KEY POINTS

• Fraudsters are targeting the HR functions of businesses of all types and convincing employees to swap out your direct deposit banking information to an offshore account. 
• One nonprofit in Kansas City describes several attempts per month, involving scammers trying to convince payroll personnel to change information about where to send employee pay. 
• The IRS has warned of an uptick in a wide range of fraud attempts involving payroll information. 

A man looks at his bank statement while on the phone.

Twenty/20

Around two or three times per month, KVC Health Systems, a midsize nonprofit agency for child welfare based in Kansas City, receives phishing emails from criminals with the goal of rerouting an employee's paycheck by direct deposit.

The emails look legitimate at first, as though they come from the CEO, CFO or payroll director.

The scammer is trying to convince human resources personnel to change the bank account and routing information the employee uses to have paychecks direct-deposited. Once routed to the criminal's account, the company is on the hook for replacing the stolen funds and the employee faces the inconvenience of a late paycheck.

It's a new version of wire fraud scams that have devastated businesses in recent years, and a more focused version of a series of payroll fraud crimes that the IRS warned late last year were on the rise. The fraud is growing, experts said, because it easily bypasses many existing technical controls, and the small sums stolen are inoffensive enough that they can be folded into the cost of doing business.

The fake emails defy many existing controls for malicious communications, said Erik Nyberg, director of information technology at KVC. They are usually well written, cordial and lack the misspellings, grammar mistakes and exclamation points that would trigger many popular email filters that search for spam or phishing attempts.

"They might just say, 'I need to update my direct deposit information," said Nyberg. "Or they start with, 'Hey, do you have a second?' and if that target person responds, then they go from there." KVC has had a few near misses, Nyberg said, but has not transferred any paychecks to scammers.

This email was received by personnel at KVC Health Systems -- it's another attempt to convince employees to change direct deposit information.

A new scam with a convincing pitch

The scam has only emerged in the past month, according to Adrien Gendre, chief solutions architect at email security company Vade Secure.

Many companies "have put processes in place to validate big wire transfers, so now [criminals] want to stay under the radar. It's a new approach, and every day we have more customers reporting it," he said. Gendre said a dozen Vade companies have reported attempts to change direct deposit information.

The scam does not only bypass some email controls. It also bypasses warnings companies may have already issued to their employees about wire fraud, because scammers aren't asking for money or an invoice transfer — they're simply asking to change a bank account number.

The fraudsters typically impersonate the company's higher-value employees, like the CFO or CEO, Nyberg said. The emails are usually brief, polite and lightly urgent, and often ask HR personnel to change the direct deposit information quickly, "before the next paycheck."

Others try to discourage the target from calling, by writing "I am going into a meeting now."

An email to employees at KVC Health Systems attempts to start a conversation about direct deposit by convincing the receiver to not call the employee.

The spoofing doesn't require the criminal to hack into anyone's email account, as it often does with bigger-ticket wire fraud. The scammers generate the fake emails with free services like Gmail -- the scammer simply opens a new Gmail account and fills in the employee's name — which allows them to get around tools meant to detect hacking attempts on employee email, Nyberg explained. Employees may not notice, either because they are working quickly and they don't notice the full email address, or they are working on a mobile device where only the person's name is displayed in the "from" field, he said.

Why would scammers target a nonprofit? Nyberg said he expects that the organization may be attractive in part because of its genial culture: "The nature of our work is helpful, people who are very literally here to help other people. They might also believe that our training isn't as rigorous as a Fortune 500 company," he said.

The emails are meant to be simple and direct, with few misspellings or grammatical errors that would trigger email filters.

Despite the relatively low dollar figure associated with this scam -- thousands of dollars compared with hundreds of thousands in a typical wire scam -- Gendre said it's so cheap to execute that he expects it to become more attractive for criminals.

"They have found a way to automate it, which means you can scale it. You may not make $100,000 in one hit, but you may be able to make 20 hits staying in one company, and be able to make your return [on investment]."

How to combat it

To fight the threat, Nyberg said the organization has focused on training people on a simple truth: "The CEO is never going to email you out of the blue and ask you for any deposit changes. And if you have any sliver of a doubt, call the person who is making the request."

Gendre said his company has used "natural language processing," which analyzes the language used in incoming emails to test for "urgency," then flagging those emails as potentially suspicious, especially if they come from a new email address.

Nyberg also said they've asked executives to avoid using their personal emails when sending messages to staff, and the company has also tweaked its email filters to pick up on common hallmarks of the request. Companies that see versions of the scam can also report them to the FBI's IC3 tip line.