Business Email Compromise: FinCEN Advisory Red Flags Explained

Business email compromise (BEC) is a fraud in which criminals compromise or impersonate email accounts to send false payment instructions or to obtain data that can be used for financial fraud. It is a problem for companies, finance teams, accountancy practices and the banks that process the payments. This guide summarises the US Financial Crimes Enforcement Network (FinCEN) updated advisory on email compromise fraud, FIN-2019-A005, issued on 16 July 2019. It is background to our phishing, social engineering and business email compromise course overview.

What the advisory says BEC is

According to FinCEN, BEC involves compromising or impersonating email accounts to send fraudulent payment instructions or to obtain data used for financial fraud. The 2019 update broadened the definition beyond wire transfers to include other payment methods, such as virtual currency, ACH transfers and gift cards. FinCEN distinguishes BEC, which targets operating entities, from email account compromise, which targets personal accounts.

The scheme types FinCEN describes

• Executive impersonation: fraudsters pose as senior leaders to discourage staff from questioning payment orders. FinCEN says about half of BEC fraud targeting financial institutions used this approach.
• Vendor and invoice impersonation: fraudulent invoices from supposed suppliers or clients redirect payments, often involving larger amounts and foreign intermediary beneficiaries.
• Targeted sectors: government bodies, educational institutions and real estate transactions are frequent targets because of large payment volumes and publicly available information about counterparties.
• Attacks on financial institutions: criminals spoof bank domains and send messages that imitate internal communications, such as payment instructions from a payments department.
• BEC data theft: victims are tricked into sending sensitive data, such as employee personal data or tax forms, which is then used in other frauds.

The numbers, with attribution

The advisory reports that FinCEN had received over 32,000 reports involving almost 9 billion US dollars in attempted theft since its 2016 advisory, and that monthly BEC reports rose from just under 500 in 2016, with about 110 million dollars of attempted theft, to over 1,100 in 2018, with over 300 million. FinCEN also cites the FBI as reporting over 12 billion dollars in potential losses between October 2013 and May 2018. These are figures from 2019 and earlier, and they should be read as dated.

Warning signs the advisory highlights

The advisory says its earlier red flags remain relevant and highlights several warning signs, while cautioning that activity in these sectors or jurisdictions may be legitimate, so indicators should be assessed alongside other facts:

• urgent payment requests that discourage verification, especially ones that appear to come from executives;
• unexpected vendor or client invoices;
• payments to foreign intermediary beneficiaries, or rapid onward transfers to domestic accounts;
• messages from spoofed or look-alike domains;
• email auto-forwarding rules, inbox sweep rules or malware on a victim's account; and
• transactions that do not match expected activity.

What FinCEN recommends

FinCEN recommends strengthening how communications are authenticated and transactions authorised, and verifying emailed payment requests through a separate channel with someone authorised to approve the payment before it is made, because fund transfers are often irrevocable. For recovery, it advises filing a complaint with the FBI's Internet Crime Complaint Center or contacting the local FBI or US Secret Service office, and says it has had more success when reports are made within 24 hours. It also says a suspicious activity report is required for email compromise fraud involving fraudulent payment instructions, even if the attempt failed, and that contacting law enforcement does not replace that obligation. For the reporting side, see our guide to the bank SAR rule.

Reporting details for US institutions

The advisory asks US institutions to select the cyber event field on the suspicious activity report and to use key terms that identify the scheme: "BEC FRAUD" for business victims, "EAC FRAUD" for individual victims and "BEC DATA THEFT" where data was compromised. It also asks for the transaction details, relevant email and IP addresses with timestamps, and any other cyber-related evidence. It encourages institutions to use section 314(b) of the USA PATRIOT Act to share information about BEC activity with other financial institutions. These are US reporting mechanics, so firms in the UK or Ireland should follow their own national reporting channels instead.

Our suggestions for finance teams and practices

These points are our suggestions, not statements in the advisory. Agree a call-back rule for any change to bank details, using a number you already hold rather than one in the email. Require a second approver for new payees and urgent payments. Switch on multi-factor authentication for email and look for unexpected forwarding rules. Practise what to do in the first hour after a suspected incident, including who calls the bank. If you want structured training for your team, browse our CPD courses.

What we could not confirm

This is a US advisory from 2019, and we have not reviewed more recent FinCEN, FBI or UK and Irish guidance, or current loss statistics. The advisory refers readers to the 2016 advisory for its full list of red flags, which we did not read. The reporting rules described apply to US financial institutions and do not set UK or Irish obligations. This post is general information, not legal advice.