The U.S. Federal Bureau of Investigation (FBI) this week warned about a “dramatic” increase in so-called “CEO fraud,” e-mail scams in which the attacker spoofs a message from the boss and tricks someone at the organization into wiring funds to the fraudsters. The FBI estimates these scams have cost organizations more than $2.3 billion in losses over the past three years. 
 
 In an alert posted to its site, the FBI said that since January 2015, the agency has seen a 270 percent increase in identified victims and exposed losses from CEO scams. The alert noted that law enforcement globally has received complaints from victims in every U.S. state, and in at least 79 countries. 
 
 CEO fraud usually begins with the thieves either phishing an executive and gaining access to that individual’s inbox, or emailing employees from a look-alike domain name that is one or two letters off from the target company’s true domain name. For example, if the target company’s domain was “example.com” the thieves might register “examp1e.com” (substituting the letter “L” for the numeral 1) or “example.co,” and send messages from that domain. 
 
 Unlike traditional phishing scams, spoofed emails used in CEO fraud schemes rarely set off spam traps because these are targeted phishing scams that are not mass e-mailed. Also, the crooks behind them take the time to understand the target organization’s relationships, activities, interests and travel and/or purchasing plans. 
 
 They do this by scraping employee email addresses and other information from the target’s Web site to help make the missives more convincing. In the case where executives or employees have their inboxes compromised by the thieves, the crooks will scour the victim’s email correspondence for certain words that might reveal whether the company routinely deals with wire transfers — searching for messages with key words like “invoice,” “deposit” and “president.” 
 
 On the surface, business email compromise scams may seem unsophisticated relative to moneymaking schemes that involve complex malicious software, such as Dyre and ZeuS. But in many ways, CEO fraud is more versatile and adept at sidestepping basic security strategies used by banks and their customers to minimize risks associated with account takeovers. In traditional phishing scams, the attackers interact with the victim’s bank directly, but in the CEO scam the crooks trick the victim into doing that for them. 
 
 The FBI estimates that organizations victimized by CEO fraud attacks lose on average between $25,000 and $75,000. But some CEO fraud incidents over the past year have cost victim companies millions — if not tens of millions — of dollars. 
 
 Last month, the Associated Press wrote that toy maker Mattel lost $3 million in 2015 thanks to a CEO fraud phishing scam. In 2015, tech firm Ubiquiti disclosed in a quarterly financial report that it suffered a whopping $46.7 million hit because of a CEO fraud scam. In February 2015, email con artists made off with $17.2 million from The Scoular Co., an employee-owned commodities trader. More recently, I wrote about a slightly more complex CEO fraud scheme that incorporated a phony phone call from a phisher posing as an accountant at KPMG. 
 
 The FBI urges businesses to adopt two-step or two-factor authentication for email, where available, and to establish other communication channels — such as telephone calls — to verify significant transactions. Businesses are also advised to exercise restraint when publishing information about employee activities on their Web sites or through social media, as attackers perpetrating these schemes often will try to discover information about when executives at the targeted organization will be traveling or otherwise out of the office. 
 
 For an example of what some of these CEO fraud scams look like, check out this post from security education and awareness firm Phishme about scam artists trying to target the company’s leadership. 
 
 I’m always amazed when I hear security professionals I know and respect make comments suggesting that phishing and spam are solved problems. The right mix of blacklisting and email validation regimes like DKIM and SPF can block the vast majority of this junk, these experts argue. 
 
 But CEO fraud attacks succeed because they rely almost entirely on tricking employees into ignoring or sidestepping some very basic security precautions. Educating employees so that they are less likely to fall for these scams won’t block all social engineering attacks, but it should help. Remember, the attackers are constantly testing users’ security awareness. Organizations might as well be doing the same, using periodic tests to identify problematic users and to place additional security controls on those individuals. 
 
 Tags: ceo fraud, dkim, Dyre, fbi, phishme, spf, The Scoular Co., Ubiquiti, zeus ||||| Media playback is unsupported on your device Media caption CEO fraud is on the rise, especially in France. But why is it so successful? 
 
 It's a boss's worst nightmare. 
 
 You return from a trip to find that hundreds of thousands of dollars has been transferred out of company accounts - apparently at your instruction. 
 
 But you have no idea what your accountant is talking about - you didn't give any instructions. 
 
 This is what happened to Carole Gratzmuller, boss of a medium-sized French company called Etna Industrie. 
 
 Her firm, which employs 50 people and has been making industrial equipment on the outskirts of Paris for nearly 75 years, was the victim of a specialised email phishing attack dubbed CEO fraud, or "fraude au president" as they call it in France. 
 
 'Confidential transaction' 
 
 "My accountant was called on Friday morning," she tells the BBC. "Someone said: 'You're going to get an email from the president, and she's going to give you instructions to conduct a very confidential transaction and you're going to have to respond to whatever instructions she gives you'." 
 
 The accountant was then emailed from an address with Ms Gratzmuller's name in it, saying Etna Industrie was buying a company in Cyprus. 
 
 The email said the accountant was going to get a phone call from a consultant working with a lawyer, who would then give her instructions as to where to transfer the money. 
 
 "Everything happened between 9 and 10 o'clock," says Ms Gratzmuller. "The accountant probably got about 10 emails in that time and three or four different phone calls. 
 
 Image caption Parisian industrial equipment maker Etna Industrie might have folded if the scam had succeeded 
 
 The fraudsters pressured her into acting quickly, without thinking - a standard feature of this type of phishing fraud. 
 
 "They didn't give her a moment to sit back and think that this was unusual," she says. 
 
 'Vulnerable' 
 
 Before noon the accountant had authorised wire transfers totalling €500,000 (£372,000; $542,000) to foreign bank accounts. 
 
 Luckily for Etna Industrie, three of the wire transfers were held up by the banks, but one for €100,000 went through. 
 
 The many faces of business email fraud 
 
 Image copyright Thinkstock Image caption Who's really hiding behind the mask? 
 
 Someone poses as a boss of a company instructing staff to make a wire transfer into the fraudster's account Fraudsters pose as the IT services department of a bank saying they want to make a test transfer - but it's not a test Fraudsters claim to be a supplier and ask for outstanding invoices to be paid into a new bank account Employees click on links within phishing emails containing malware which authorises many small payments to the fraudster's account 
 
 The company got this money back after the bank in question was found to be at fault by the French courts. However, the bank is appealing against the decision. 
 
 "It's like when your house or apartment gets broken into," says Ms Gratzmuller. "You feel vulnerable. People get into your life and they know things about you and you have no clue, and they take things from you." 
 
 French connection 
 
 But the case of Etna Industrie is small fry compared to the scale of "fraude au president" across France as a whole. 
 
 French businesses have lost an estimated €465m since 2010, official figures suggest, with 15,000 firms falling victim to the scam, including big names, such as Michelin, KPMG and Nestle. 
 
 Image copyright Getty Images Image caption Tyre maker Michelin is one of many French big-name firms who've fallen for the fraud 
 
 The biggest fraud was for €32m, and a further €830m could have been stolen if more phishing attacks had proved successful, say French police. 
 
 Matthieu Bares, deputy head of their financial crime division, says there are one or two attacks on French companies every day, but that "plenty of victims don't report the fraud". 
 
 But why France in particular? 
 
 Gilbert Chikli, a French-Israeli man, may have a lot to do with it. He defrauded more than 30 banks and companies out of €7.9m during 2005 and 2006, pretending to be, variously, company heads and secret service agents. 
 
 Chikli fled to Israel in 2009 and in his absence was sentenced to seven years in prison last year. 
 
 Image copyright AP Image caption President Hollande's partner Julie Gayet is making a film about fraudster Gilbert Chikli 
 
 With no extradition agreement between Israel and France, Chikli remains living in Tel Aviv, and a film based on his life is being made - starring French president Francois Hollande's girlfriend, Julie Gayet. 
 
 It is still predominantly French-Israeli gangs running the fraud, police say, and their ability to impersonate French bosses has seen France bearing the brunt of the onslaught in Europe. 
 
 Global spread 
 
 But CEO fraud is not just a French problem. 
 
 In the US, the FBI's internet crime centre or IC3 has been tracking "business email compromise" scams, as it calls them, and reckons about 7,000 companies have been defrauded of more than $740m (£508m; €682m) over the last two years. 
 
 The real figure is likely to be much higher though, given how reluctant many companies are to admit being defrauded in this way. 
 
 Image copyright Getty Images Image caption Although France has been particularly prone to CEO fraud, it is also a global problem 
 
 "We think more than $2bn has been lost to business email scams over the last two years," says Aaron Higbee, co-founder and chief technology officer of PhishMe, a US security company specialising in educating staff about phishing attacks. 
 
 One US company, Ubiquiti Networks, a wireless network equipment manufacturer, admitted to wiring $39.1m to fraudsters after falling victim to this type of scam repeatedly last year. 
 
 "Fraudsters are increasing the intensity of attacks," says Amichai Shulman, chief technology officer at data security company, Imperva. "So it only takes a tiny percentage to get through to be effective. There are not enough policing resources in cyberspace to monitor them all." 
 
 Social engineering 
 
 But why is CEO fraud proving so effective? 
 
 Mr Higbee suggests it because this type of email can more easily bypass spam filters and antivirus security systems. 
 
 "It doesn't need attachments carrying malware, it's just a conversation," he says. "It's very low-tech and a big departure from the large, automated malware attacks we're used to." 
 
 Image copyright Thinkstock Image caption Is that urgent email from your boss actually from a fraudster exploiting your credulity? 
 
 Fraudsters use publicly available corporate data gleaned from the internet to make the emails as convincing as possible, finding out who the bosses and senior financial officers are from social networks like LinkedIn, for example. 
 
 Staff are less likely to question instructions purporting to come from on high, and it's this psychological manipulation - often accompanied by a sense of urgency - that is a major factor in the fraud's success. 
 
 "It will spread because it's too good to be ignored," warns Jerome Robert from French cybersecurity company, Lexsi. "[Criminals] can make so much money in a very small amount of time, with minimal risk." 
 
 Businesses should be on their guard. 
 
 Listen to BBC World Business Report's How not to be a victim of internet scams 
 
 Follow Technology of Business editor Matthew Wall on Twitter: @matthew_wall ||||| FBI officials are warning potential victims of a dramatic rise in the business e-mail compromise scam or “B.E.C.,” a scheme that targets businesses and has resulted in massive financial losses in Phoenix and other cities. 
 
 The schemers go to great lengths to spoof company e-mail or use social engineering to assume the identity of the CEO, a company attorney, or trusted vendor. They research employees who manage money and use language specific to the company they are targeting, then they request a wire fraud transfer using dollar amounts that lend legitimacy. 
 
 There are various versions of the scams. Victims range from large corporations to tech companies to small businesses to non-profit organizations. Many times, the fraud targets businesses that work with foreign suppliers or regularly perform wire transfer payments. 
 
 Law enforcement globally has received complaints from victims in every U.S. state and in at least 79 countries. 
 
 From October 2013 through February 2016, law enforcement received reports from 17,642 victims. 
 
 This amounted to more than $2.3 billion in losses. 
 
 Since January 2015, the FBI has seen a 270 percent increase in identified victims and exposed loss. 
 
 In Arizona the average loss per scam is between $25,000 and $75,000. 
 
 If your company has been victimized by a BEC scam: 
 
 Contact your financial institution immediately 
 
 Request that they contact the financial institution where the fraudulent transfer was sent 
 
 File a complaint—regardless of dollar loss—with the IC3. 
 
 Tips for Businesses: 
 
 Be wary of e-mail-only wire transfer requests and requests involving urgency 
 
 Pick up the phone and verify legitimate business partners. 
 
 Be cautious of mimicked e-mail addresses 
 
 Practice multi-level authentication. 
 
 Resources: ||||| CLOSE Police departments across the country responded to bomb threats emailed to targets demanding bitcoin. USA TODAY 
 
 A sextortion email sent in December. The wording in the email is very similar to wording in bomb threat cyber extortion emails sent to hundreds of sites in the United States on December 12, 2018. (Photo: AppRiver security company) 
 
 SAN FRANCISCO — A wave of hoax bomb threats that swept the United States on Thursday were a variant on a relatively new cyber extortion scheme — one that previously threatened it had compromising personal videos of a sexual nature. 
 
 Who was behind the campaign isn't known, as it is difficult to trace the origin of such emails. The motivation is also unclear. It could have been money or it could have been something more nefarious such as causing mass disruption, say experts. 
 
 Thursday's hoax bomb threat emails hit universities, businesses, schools and news outlets across the country, sending police departments scrambling. 
 
 The emails were all variants on a theme that the sender had hired a "recruited mercenary" to place an explosive device in the targeted building that would be detonated unless $20,000 in difficult-to-trace cybercurrency was paid. 
 
 There were no reports that any actual explosive devices were discovered, but the threats alone cost thousands of dollars as buildings emptied and police officers monitored and investigated. 
 
 Similar to British wanker emails 
 
 The emails that appeared Thursday were similar to extortion campaigns sent to people in Europe that have threatened bombs or the release of compromising sex videos. 
 
 In May, over 400 schools in the United Kingdom received bomb threat emails, none of which were deemed credible by local authorities, though not until they had disrupted the schools. 
 
 The emails sent Thursday were in some cases close variations on those sextortion emails, said David Pickett, a cybersecurity analyst for Florida-based AppRiver, a computer security firm. Some of them were also sent from the same computer servers as Thursday's bomb hoax emails. 
 
 "I would give it a 99 percent chance that it's the same group," Pickett said. 
 
 The sextortion emails threatened that the perpetrator had installed a program on the user's computer which allowed the criminals to tap into the machine's camera. 
 
 The scammers claimed the program captured "videotape with you self-abusing," as well as the snippet of pornography they were watching. It threatened to send the video to all their contacts if they didn't pay the equivalent of about $850 to a Bitcoin address. 
 
 It was all a hoax and no program, or video, actually existed, said Pickett. 
 
 The senders' program was sophisticated enough to randomly swap other words into the message, such as "masturbation" and "wanking" to make it harder to target against, he said. It was written in special characters that Outlook and other email programs automatically translated into normal letters, allowing it to fool spam filters set to capture such emails. 
 
 More could be coming 
 
 Attempts to use the internet to extort money from people are decades old. Over the past several years ransomware, which installs malware that locks up the user's computer files until they pay a ransom, has been popular with cybercriminals. 
 
 The hoax cyber extortion emails are a relatively new variant. "This group's been active for about the last six months," Pickett said. 
 
 It could be that more will come because cybercriminals are lazy and copycat attacks pop up very quickly, said Atiq Raza, CEO of Virsec, a computer security firm based in San Jose, California. 
 
 "I expect this to pick up over the next year. Once people figure out that this is a way to extort money, they will use it," he said. 
 
 Attacks such as this are no-brainers for cybercriminals because they are so cheap. Sending the same email to tens of thousands of people costs almost nothing "and if just one pays, it's been worth it," Raza said. 
 
 Different because disruptive 
 
 These hoax bomb extortion emails, while fake, are extremely disruptive because authorities have to take them seriously for safety's sake. 
 
 In that way, they are different from ransomware and sextortion attempts which tend not to be reported to police or reported in the news. That's because those receiving them generally want to keep the matter quiet — either to protect their business' reputation or their own. 
 
 Some believe the likelihood of anyone actually getting money out of this attack is low and that there are other reasons it was launched. 
 
 "This isn’t about extortion, it is about causing disruption. It worked," said Colin Bastable, CEO of security awareness training company Lucy Security. 
 
 He believes it was a trial run to see how America responds in such cases. Because the answer was with an abundance of caution on the part of law enforcement, he worries it will encourage more such campaigns. 
 
 One positive is that the very public nature of the attack should help innoculate the public, as these schemes rely on the victim believing that the attacker is capable of carrying out the threat. 
 
 "The widespread nature of this email campaign makes it much less likely that the victims will believe the attacker is serious," said Tim Erlin, vice president of strategy at Tripwire, a Portland, Oregon-based cybersecurity firm. "I would expect email extortion to continue, but not at this scale." 
 
 If however, the motive is to create mass disruption, it could mean bigger worries, said Mounir Hahad, head of the Juniper Threat Labs at Juniper Networks. 
 
 The threat could be "to stress law enforcement resources while possibly perpetrating a secondary more potent attack," he said. 
 
 Read or Share this story: https://www.usatoday.com/story/news/2018/12/13/hoax-bomb-threat-extortion-emails-similar-sex-video-extortions/2306911002/
– A relatively new email scam is raking in millions of dollars, and it's got nothing to do with long-lost relatives in Nigeria. Instead, as Quartz explains, the "CEO Email Scam" dupes employees into wiring money by using bogus messages from the boss. The scammers do their homework: They assume the identity of a company CEO, or sometimes simply send an email so close to the correct email that the recipient never notices the difference. The requests go to someone in the company authorized to deal with money, usually demanding quick action—and confidentiality—because of a pending business deal. It's been so successful that the FBI issued an alert last week, citing complaints in every state and in 79 countries. "On the surface, business email compromise scams may seem unsophisticated relative to moneymaking schemes that involve complex malicious software," writes Brian Krebs of Krebs on Security. But the CEO scam is especially effective because of one crucial factor: "In traditional phishing scams, the attackers interact with the victim’s bank directly, but in the CEO scam the crooks trick the victim into doing that for them." When it works, a typical haul is between $25,000 and $75,000. The known haul worldwide is $2.3 billion, says the FBI. One cybersecurity expert in France warns that it won't go away any time soon. "It will spread because it's too good to be ignored," he tells the BBC.