The U.S. Federal Bureau of Investigation (FBI) this week warned about a “dramatic” increase in so-called “CEO fraud,” e-mail scams in which the attacker spoofs a message from the boss and tricks someone at the organization into wiring funds to the fraudsters. The FBI estimates these scams have cost organizations more than $2.3 billion in losses over the past three years. 
 
 In an alert posted to its site, the FBI said that since January 2015, the agency has seen a 270 percent increase in identified victims and exposed losses from CEO scams. The alert noted that law enforcement globally has received complaints from victims in every U.S. state, and in at least 79 countries. 
 
 CEO fraud usually begins with the thieves either phishing an executive and gaining access to that individual’s inbox, or emailing employees from a look-alike domain name that is one or two letters off from the target company’s true domain name. For example, if the target company’s domain was “example.com” the thieves might register “examp1e.com” (substituting the letter “L” for the numeral 1) or “example.co,” and send messages from that domain. 
 
 Unlike traditional phishing scams, spoofed emails used in CEO fraud schemes rarely set off spam traps because these are targeted phishing scams that are not mass e-mailed. Also, the crooks behind them take the time to understand the target organization’s relationships, activities, interests and travel and/or purchasing plans. 
 
 They do this by scraping employee email addresses and other information from the target’s Web site to help make the missives more convincing. In the case where executives or employees have their inboxes compromised by the thieves, the crooks will scour the victim’s email correspondence for certain words that might reveal whether the company routinely deals with wire transfers — searching for messages with key words like “invoice,” “deposit” and “president.” 
 
 On the surface, business email compromise scams may seem unsophisticated relative to moneymaking schemes that involve complex malicious software, such as Dyre and ZeuS. But in many ways, CEO fraud is more versatile and adept at sidestepping basic security strategies used by banks and their customers to minimize risks associated with account takeovers. In traditional phishing scams, the attackers interact with the victim’s bank directly, but in the CEO scam the crooks trick the victim into doing that for them. 
 
 The FBI estimates that organizations victimized by CEO fraud attacks lose on average between $25,000 and $75,000. But some CEO fraud incidents over the past year have cost victim companies millions — if not tens of millions — of dollars. 
 
 Last month, the Associated Press wrote that toy maker Mattel lost $3 million in 2015 thanks to a CEO fraud phishing scam. In 2015, tech firm Ubiquiti disclosed in a quarterly financial report that it suffered a whopping $46.7 million hit because of a CEO fraud scam. In February 2015, email con artists made off with $17.2 million from The Scoular Co., an employee-owned commodities trader. More recently, I wrote about a slightly more complex CEO fraud scheme that incorporated a phony phone call from a phisher posing as an accountant at KPMG. 
 
 The FBI urges businesses to adopt two-step or two-factor authentication for email, where available, and to establish other communication channels — such as telephone calls — to verify significant transactions. Businesses are also advised to exercise restraint when publishing information about employee activities on their Web sites or through social media, as attackers perpetrating these schemes often will try to discover information about when executives at the targeted organization will be traveling or otherwise out of the office. 
 
 For an example of what some of these CEO fraud scams look like, check out this post from security education and awareness firm Phishme about scam artists trying to target the company’s leadership. 
 
 I’m always amazed when I hear security professionals I know and respect make comments suggesting that phishing and spam are solved problems. The right mix of blacklisting and email validation regimes like DKIM and SPF can block the vast majority of this junk, these experts argue. 
 
 But CEO fraud attacks succeed because they rely almost entirely on tricking employees into ignoring or sidestepping some very basic security precautions. Educating employees so that they are less likely to fall for these scams won’t block all social engineering attacks, but it should help. Remember, the attackers are constantly testing users’ security awareness. Organizations might as well be doing the same, using periodic tests to identify problematic users and to place additional security controls on those individuals. 
 
 Tags: ceo fraud, dkim, Dyre, fbi, phishme, spf, The Scoular Co., Ubiquiti, zeus ||||| Media playback is unsupported on your device Media caption CEO fraud is on the rise, especially in France. But why is it so successful? 
 
 It's a boss's worst nightmare. 
 
 You return from a trip to find that hundreds of thousands of dollars has been transferred out of company accounts - apparently at your instruction. 
 
 But you have no idea what your accountant is talking about - you didn't give any instructions. 
 
 This is what happened to Carole Gratzmuller, boss of a medium-sized French company called Etna Industrie. 
 
 Her firm, which employs 50 people and has been making industrial equipment on the outskirts of Paris for nearly 75 years, was the victim of a specialised email phishing attack dubbed CEO fraud, or "fraude au president" as they call it in France. 
 
 'Confidential transaction' 
 
 "My accountant was called on Friday morning," she tells the BBC. "Someone said: 'You're going to get an email from the president, and she's going to give you instructions to conduct a very confidential transaction and you're going to have to respond to whatever instructions she gives you'." 
 
 The accountant was then emailed from an address with Ms Gratzmuller's name in it, saying Etna Industrie was buying a company in Cyprus. 
 
 The email said the accountant was going to get a phone call from a consultant working with a lawyer, who would then give her instructions as to where to transfer the money. 
 
 "Everything happened between 9 and 10 o'clock," says Ms Gratzmuller. "The accountant probably got about 10 emails in that time and three or four different phone calls. 
 
 Image caption Parisian industrial equipment maker Etna Industrie might have folded if the scam had succeeded 
 
 The fraudsters pressured her into acting quickly, without thinking - a standard feature of this type of phishing fraud. 
 
 "They didn't give her a moment to sit back and think that this was unusual," she says. 
 
 'Vulnerable' 
 
 Before noon the accountant had authorised wire transfers totalling €500,000 (£372,000; $542,000) to foreign bank accounts. 
 
 Luckily for Etna Industrie, three of the wire transfers were held up by the banks, but one for €100,000 went through. 
 
 The many faces of business email fraud 
 
 Image copyright Thinkstock Image caption Who's really hiding behind the mask? 
 
 Someone poses as a boss of a company instructing staff to make a wire transfer into the fraudster's account Fraudsters pose as the IT services department of a bank saying they want to make a test transfer - but it's not a test Fraudsters claim to be a supplier and ask for outstanding invoices to be paid into a new bank account Employees click on links within phishing emails containing malware which authorises many small payments to the fraudster's account 
 
 The company got this money back after the bank in question was found to be at fault by the French courts. However, the bank is appealing against the decision. 
 
 "It's like when your house or apartment gets broken into," says Ms Gratzmuller. "You feel vulnerable. People get into your life and they know things about you and you have no clue, and they take things from you." 
 
 French connection 
 
 But the case of Etna Industrie is small fry compared to the scale of "fraude au president" across France as a whole. 
 
 French businesses have lost an estimated €465m since 2010, official figures suggest, with 15,000 firms falling victim to the scam, including big names, such as Michelin, KPMG and Nestle. 
 
 Image copyright Getty Images Image caption Tyre maker Michelin is one of many French big-name firms who've fallen for the fraud 
 
 The biggest fraud was for €32m, and a further €830m could have been stolen if more phishing attacks had proved successful, say French police. 
 
 Matthieu Bares, deputy head of their financial crime division, says there are one or two attacks on French companies every day, but that "plenty of victims don't report the fraud". 
 
 But why France in particular? 
 
 Gilbert Chikli, a French-Israeli man, may have a lot to do with it. He defrauded more than 30 banks and companies out of €7.9m during 2005 and 2006, pretending to be, variously, company heads and secret service agents. 
 
 Chikli fled to Israel in 2009 and in his absence was sentenced to seven years in prison last year. 
 
 Image copyright AP Image caption President Hollande's partner Julie Gayet is making a film about fraudster Gilbert Chikli 
 
 With no extradition agreement between Israel and France, Chikli remains living in Tel Aviv, and a film based on his life is being made - starring French president Francois Hollande's girlfriend, Julie Gayet. 
 
 It is still predominantly French-Israeli gangs running the fraud, police say, and their ability to impersonate French bosses has seen France bearing the brunt of the onslaught in Europe. 
 
 Global spread 
 
 But CEO fraud is not just a French problem. 
 
 In the US, the FBI's internet crime centre or IC3 has been tracking "business email compromise" scams, as it calls them, and reckons about 7,000 companies have been defrauded of more than $740m (£508m; €682m) over the last two years. 
 
 The real figure is likely to be much higher though, given how reluctant many companies are to admit being defrauded in this way. 
 
 Image copyright Getty Images Image caption Although France has been particularly prone to CEO fraud, it is also a global problem 
 
 "We think more than $2bn has been lost to business email scams over the last two years," says Aaron Higbee, co-founder and chief technology officer of PhishMe, a US security company specialising in educating staff about phishing attacks. 
 
 One US company, Ubiquiti Networks, a wireless network equipment manufacturer, admitted to wiring $39.1m to fraudsters after falling victim to this type of scam repeatedly last year. 
 
 "Fraudsters are increasing the intensity of attacks," says Amichai Shulman, chief technology officer at data security company, Imperva. "So it only takes a tiny percentage to get through to be effective. There are not enough policing resources in cyberspace to monitor them all." 
 
 Social engineering 
 
 But why is CEO fraud proving so effective? 
 
 Mr Higbee suggests it because this type of email can more easily bypass spam filters and antivirus security systems. 
 
 "It doesn't need attachments carrying malware, it's just a conversation," he says. "It's very low-tech and a big departure from the large, automated malware attacks we're used to." 
 
 Image copyright Thinkstock Image caption Is that urgent email from your boss actually from a fraudster exploiting your credulity? 
 
 Fraudsters use publicly available corporate data gleaned from the internet to make the emails as convincing as possible, finding out who the bosses and senior financial officers are from social networks like LinkedIn, for example. 
 
 Staff are less likely to question instructions purporting to come from on high, and it's this psychological manipulation - often accompanied by a sense of urgency - that is a major factor in the fraud's success. 
 
 "It will spread because it's too good to be ignored," warns Jerome Robert from French cybersecurity company, Lexsi. "[Criminals] can make so much money in a very small amount of time, with minimal risk." 
 
 Businesses should be on their guard. 
 
 Listen to BBC World Business Report's How not to be a victim of internet scams 
 
 Follow Technology of Business editor Matthew Wall on Twitter: @matthew_wall ||||| FBI officials are warning potential victims of a dramatic rise in the business e-mail compromise scam or “B.E.C.,” a scheme that targets businesses and has resulted in massive financial losses in Phoenix and other cities. 
 
 The schemers go to great lengths to spoof company e-mail or use social engineering to assume the identity of the CEO, a company attorney, or trusted vendor. They research employees who manage money and use language specific to the company they are targeting, then they request a wire fraud transfer using dollar amounts that lend legitimacy. 
 
 There are various versions of the scams. Victims range from large corporations to tech companies to small businesses to non-profit organizations. Many times, the fraud targets businesses that work with foreign suppliers or regularly perform wire transfer payments. 
 
 Law enforcement globally has received complaints from victims in every U.S. state and in at least 79 countries. 
 
 From October 2013 through February 2016, law enforcement received reports from 17,642 victims. 
 
 This amounted to more than $2.3 billion in losses. 
 
 Since January 2015, the FBI has seen a 270 percent increase in identified victims and exposed loss. 
 
 In Arizona the average loss per scam is between $25,000 and $75,000. 
 
 If your company has been victimized by a BEC scam: 
 
 Contact your financial institution immediately 
 
 Request that they contact the financial institution where the fraudulent transfer was sent 
 
 File a complaint—regardless of dollar loss—with the IC3. 
 
 Tips for Businesses: 
 
 Be wary of e-mail-only wire transfer requests and requests involving urgency 
 
 Pick up the phone and verify legitimate business partners. 
 
 Be cautious of mimicked e-mail addresses 
 
 Practice multi-level authentication. 
 
 Resources: ||||| Low-level MacEwan University staffers were tricked into transferring $11.8 million into scammers’ bank accounts in what one expert said is among the largest publicly disclosed phishing scams. 
 
 The majority of the money, $11.4 million, has been traced to bank accounts in Montreal and Hong Kong. 
 
 “We are fairly confident that we will be able to recover those funds, the $11.4 million,” MacEwan spokesman David Beharry said Thursday. “It’s a question of how long will it take for the university to retrieve that money.” 
 
 He said $6.3 million has been seized from the account in Montreal, and actions are underway to freeze the two accounts in Hong Kong. 
 
 The $11.8 million loss represents about one-10th of what MacEwan receives as an annual operating grant from the government of Alberta. In the 2015-16 financial year, the university received $118 million from the province out of its $237.1-million budget. 
 
 “I think it’s safe to say that there was a lot of disappointment and frustration because this came down to human error,” Beharry said. 
 
 The fraud was discovered Aug. 23 after a supplier said it had not been paid. Beharry would not identify the supplier. 
 
 Fraudsters had created a website that resembled the domain site of one of the university’s major supplier. Using that site, the fraudsters impersonated the supplier, asking the university to transfer accounts payable to a new bank account the fraudsters controlled. 
 
 Three MacEwan staffers made three payments to the bogus account over a nine-day period ending Aug. 19. The university paid out $1.9 million, $22,000, and finally $9.9 million. 
 
 Beharry would not say if the staffers have been disciplined or fired. 
 
 “The university does not believe there has been any sort of collusion,” he said. “We really believe this is simply a case of human error.” 
 
 The university is working with lawyers in Montreal, London and Hong Kong on civil action to recover the money. The status of the remaining $400,000 is not known. 
 
 MacEwan conducted an audit of its business processes after discovering the fraud and put controls in place “to prevent further incidents.” An internal audit group will also investigate the incident. 
 
 An early assessment determined that “controls around the process of changing vendor banking information were inadequate, and that a number of opportunities to identify the fraud were missed.” 
 
 David Shipley, CEO of Beauceron Security and former cyber-security lead at the University of New Brunswick, said MacEwan was likely the victim of what’s known as a business email compromise scam. 
 
 “It’s the single largest publicly disclosed amount I’ve seen,” he said. “That’s not to say there aren’t private companies that aren’t required to disclose this stuff that haven’t had (larger) losses.” 
 
 Shipley said Facebook and Google fell victim to similar scams, transferring “in the $100-million range” after being invoiced by fake suppliers. 
 
 “This is the intersection of people, process and technology,” he said. “People in that they got tricked, process in that being able to transfer that amount of money should have required additional financial controls. Technology played the smallest role — as in why didn’t their email filter it or alert them that (the sender) wasn’t who it said it was.” 
 
 Beharry said the university has funds to pay the supplier. The loss would not impact students, he said. 
 
 In a statement, Advanced Education Minister Marlin Schmidt said he is “disappointed” the university fell victim to the scam and has instructed all post-secondary institutions to review their financial controls. 
 
 “I expect post-secondary institutions to do better to protect public dollars against fraud,” Schmidt said. 
 
 With files from Juris Graney and CP 
 
 jwakefield@postmedia.com
– A relatively new email scam is raking in millions of dollars, and it's got nothing to do with long-lost relatives in Nigeria. Instead, as Quartz explains, the "CEO Email Scam" dupes employees into wiring money by using bogus messages from the boss. The scammers do their homework: They assume the identity of a company CEO, or sometimes simply send an email so close to the correct email that the recipient never notices the difference. The requests go to someone in the company authorized to deal with money, usually demanding quick action—and confidentiality—because of a pending business deal. It's been so successful that the FBI issued an alert last week, citing complaints in every state and in 79 countries. "On the surface, business email compromise scams may seem unsophisticated relative to moneymaking schemes that involve complex malicious software," writes Brian Krebs of Krebs on Security. But the CEO scam is especially effective because of one crucial factor: "In traditional phishing scams, the attackers interact with the victim’s bank directly, but in the CEO scam the crooks trick the victim into doing that for them." When it works, a typical haul is between $25,000 and $75,000. The known haul worldwide is $2.3 billion, says the FBI. One cybersecurity expert in France warns that it won't go away any time soon. "It will spread because it's too good to be ignored," he tells the BBC.