text: Media playback is unsupported on your device Media caption CEO fraud is on the rise, especially in France. But why is it so successful? 
   
   It's a boss's worst nightmare. 
   
   You return from a trip to find that hundreds of thousands of dollars has been transferred out of company accounts - apparently at your instruction. 
   
   But you have no idea what your accountant is talking about - you didn't give any instructions. 
   
   This is what happened to Carole Gratzmuller, boss of a medium-sized French company called Etna Industrie. 
   
   Her firm, which employs 50 people and has been making industrial equipment on the outskirts of Paris for nearly 75 years, was the victim of a specialised email phishing attack dubbed CEO fraud, or "fraude au president" as they call it in France. 
   
   'Confidential transaction' 
   
   "My accountant was called on Friday morning," she tells the BBC. "Someone said: 'You're going to get an email from the president, and she's going to give you instructions to conduct a very confidential transaction and you're going to have to respond to whatever instructions she gives you'." 
   
   The accountant was then emailed from an address with Ms Gratzmuller's name in it, saying Etna Industrie was buying a company in Cyprus. 
   
   The email said the accountant was going to get a phone call from a consultant working with a lawyer, who would then give her instructions as to where to transfer the money. 
   
   "Everything happened between 9 and 10 o'clock," says Ms Gratzmuller. "The accountant probably got about 10 emails in that time and three or four different phone calls. 
   
   Image caption Parisian industrial equipment maker Etna Industrie might have folded if the scam had succeeded 
   
   The fraudsters pressured her into acting quickly, without thinking - a standard feature of this type of phishing fraud. 
   
   "They didn't give her a moment to sit back and think that this was unusual," she says. 
   
   'Vulnerable' 
   
   Before noon the accountant had authorised wire transfers totalling €500,000 (£372,000; $542,000) to foreign bank accounts. 
   
   Luckily for Etna Industrie, three of the wire transfers were held up by the banks, but one for €100,000 went through. 
   
   The many faces of business email fraud 
   
   Image copyright Thinkstock Image caption Who's really hiding behind the mask? 
   
   Someone poses as a boss of a company instructing staff to make a wire transfer into the fraudster's account Fraudsters pose as the IT services department of a bank saying they want to make a test transfer - but it's not a test Fraudsters claim to be a supplier and ask for outstanding invoices to be paid into a new bank account Employees click on links within phishing emails containing malware which authorises many small payments to the fraudster's account 
   
   The company got this money back after the bank in question was found to be at fault by the French courts. However, the bank is appealing against the decision. 
   
   "It's like when your house or apartment gets broken into," says Ms Gratzmuller. "You feel vulnerable. People get into your life and they know things about you and you have no clue, and they take things from you." 
   
   French connection 
   
   But the case of Etna Industrie is small fry compared to the scale of "fraude au president" across France as a whole. 
   
   French businesses have lost an estimated €465m since 2010, official figures suggest, with 15,000 firms falling victim to the scam, including big names, such as Michelin, KPMG and Nestle. 
   
   Image copyright Getty Images Image caption Tyre maker Michelin is one of many French big-name firms who've fallen for the fraud 
   
   The biggest fraud was for €32m, and a further €830m could have been stolen if more phishing attacks had proved successful, say French police. 
   
   Matthieu Bares, deputy head of their financial crime division, says there are one or two attacks on French companies every day, but that "plenty of victims don't report the fraud". 
   
   But why France in particular? 
   
   Gilbert Chikli, a French-Israeli man, may have a lot to do with it. He defrauded more than 30 banks and companies out of €7.9m during 2005 and 2006, pretending to be, variously, company heads and secret service agents. 
   
   Chikli fled to Israel in 2009 and in his absence was sentenced to seven years in prison last year. 
   
   Image copyright AP Image caption President Hollande's partner Julie Gayet is making a film about fraudster Gilbert Chikli 
   
   With no extradition agreement between Israel and France, Chikli remains living in Tel Aviv, and a film based on his life is being made - starring French president Francois Hollande's girlfriend, Julie Gayet. 
   
   It is still predominantly French-Israeli gangs running the fraud, police say, and their ability to impersonate French bosses has seen France bearing the brunt of the onslaught in Europe. 
   
   Global spread 
   
   But CEO fraud is not just a French problem. 
   
   In the US, the FBI's internet crime centre or IC3 has been tracking "business email compromise" scams, as it calls them, and reckons about 7,000 companies have been defrauded of more than $740m (£508m; €682m) over the last two years. 
   
   The real figure is likely to be much higher though, given how reluctant many companies are to admit being defrauded in this way. 
   
   Image copyright Getty Images Image caption Although France has been particularly prone to CEO fraud, it is also a global problem 
   
   "We think more than $2bn has been lost to business email scams over the last two years," says Aaron Higbee, co-founder and chief technology officer of PhishMe, a US security company specialising in educating staff about phishing attacks. 
   
   One US company, Ubiquiti Networks, a wireless network equipment manufacturer, admitted to wiring $39.1m to fraudsters after falling victim to this type of scam repeatedly last year. 
   
   "Fraudsters are increasing the intensity of attacks," says Amichai Shulman, chief technology officer at data security company, Imperva. "So it only takes a tiny percentage to get through to be effective. There are not enough policing resources in cyberspace to monitor them all." 
   
   Social engineering 
   
   But why is CEO fraud proving so effective? 
   
   Mr Higbee suggests it because this type of email can more easily bypass spam filters and antivirus security systems. 
   
   "It doesn't need attachments carrying malware, it's just a conversation," he says. "It's very low-tech and a big departure from the large, automated malware attacks we're used to." 
   
   Image copyright Thinkstock Image caption Is that urgent email from your boss actually from a fraudster exploiting your credulity? 
   
   Fraudsters use publicly available corporate data gleaned from the internet to make the emails as convincing as possible, finding out who the bosses and senior financial officers are from social networks like LinkedIn, for example. 
   
   Staff are less likely to question instructions purporting to come from on high, and it's this psychological manipulation - often accompanied by a sense of urgency - that is a major factor in the fraud's success. 
   
   "It will spread because it's too good to be ignored," warns Jerome Robert from French cybersecurity company, Lexsi. "[Criminals] can make so much money in a very small amount of time, with minimal risk." 
   
   Businesses should be on their guard. 
   
   Listen to BBC World Business Report's How not to be a victim of internet scams 
   
   Follow Technology of Business editor Matthew Wall on Twitter: @matthew_wall ||||| FBI officials are warning potential victims of a dramatic rise in the business e-mail compromise scam or “B.E.C.,” a scheme that targets businesses and has resulted in massive financial losses in Phoenix and other cities. 
   
   The schemers go to great lengths to spoof company e-mail or use social engineering to assume the identity of the CEO, a company attorney, or trusted vendor. They research employees who manage money and use language specific to the company they are targeting, then they request a wire fraud transfer using dollar amounts that lend legitimacy. 
   
   There are various versions of the scams. Victims range from large corporations to tech companies to small businesses to non-profit organizations. Many times, the fraud targets businesses that work with foreign suppliers or regularly perform wire transfer payments. 
   
   Law enforcement globally has received complaints from victims in every U.S. state and in at least 79 countries. 
   
   From October 2013 through February 2016, law enforcement received reports from 17,642 victims. 
   
   This amounted to more than $2.3 billion in losses. 
   
   Since January 2015, the FBI has seen a 270 percent increase in identified victims and exposed loss. 
   
   In Arizona the average loss per scam is between $25,000 and $75,000. 
   
   If your company has been victimized by a BEC scam: 
   
   Contact your financial institution immediately 
   
   Request that they contact the financial institution where the fraudulent transfer was sent 
   
   File a complaint—regardless of dollar loss—with the IC3. 
   
   Tips for Businesses: 
   
   Be wary of e-mail-only wire transfer requests and requests involving urgency 
   
   Pick up the phone and verify legitimate business partners. 
   
   Be cautious of mimicked e-mail addresses 
   
   Practice multi-level authentication. 
   
   Resources: ||||| An entrepreneur has come to the rescue of unmarried couples in Delhi and Mumbai. 
   
   Young couples looking for some privacy in conservative India are often vulnerable to physical attacks by the police and self-appointed guardians of “Indian culture.” Vigilante groups have assaulted lovers in parks, beaches, and pubs for engaging in any sort of public display of affection. As a result, consenting adults, if they are unmarried, often struggle to find hotel rooms for some private time. 
   
   Enter StayUncle. The New Delhi-based startup has tied up with hotels where unmarried couples can rent rooms for a duration as short as 8-10 hours. The idea is to help them with affordable rooms, without feeling uncomfortable or unsafe. 
   
   “There is no law in India that prohibits (unmarried) couples from renting a room,” Sanchit Sethi, founder of the year-old startup, told Quartz in a phone interview. “As long as you have a government identity card, you should be given a room. We don’t live in the 1950s anymore. What we are trying to do is change the mindset of hoteliers.” 
   
   “Couples need a room. Not a judgement.” 
   
   Sethi’s initial business plan was to offer hotel rooms for short durations to travellers. Most hotels in India take reservations on a 24-hour basis—a relatively expensive affair. Together with Blaze Arizanov, a digital marketer, the duo launched StayUncle in April 2015. New Delhi’s Hotel Shimla Heritage became StayUncle’s first tie-up. 
   
   The company also received its first angel investment of a “couple of lakhs” from Ajay Naqvi, the country marketing manager for Airbnb, according to Sethi. 
   
   “What was surprising was that 99% of the enquiries we were receiving were from unmarried couples looking for rooms,” said Sethi, a Birla Institute of Technology and Science (BITS)-Pilani graduate. That’s when StayUncle decided to take a relook at its business. 
   
   “We started fresh all over again. This time, with the focus on unmarried couples,” said Sethi. 
   
   Uncle starts scaling up 
   
   In December 2015, Ace Residency, a budget hotel in New Delhi’s upmarket Greater Kailash neighbourhood, partnered with StayUncle. This was the first hotel to sign up with StayUncle that allowed rooms to be booked for unmarried couples. 
   
   Since then, the company has tied up with 34 others in the capital and 10 in Mumbai. Now, even marquee properties such as the Trident and Oberoi have joined them, according to Sethi. Over the next few months, StayUncle will also start helping young people plan surprise parties or travel, with the intention of building an ecosystem around unmarried couples. 
   
   “Out of 10 hotels we speak to, only two or three eventually sign up,” said Sethi. “This is a new industry and people often see this as going against the culture of the country and there is always the fear of moral policing.” However, in the past three months, the company has already catered to some 200 couples. 
   
   A poster by StayUncle (StayUncle/Facebook) 
   
   Many hoteliers are reluctant to join, fearing “unnecessary hassles” from cops. The police in India often harass young consenting adults and threaten them with charges of public indecency. Last August, 13 couples were picked up by cops from beaches and hotels in Mumbai for “indecent behaviour.” 
   
   A hotelier in New Delhi who spoke to Quartz on conditions of anonymity confirmed that StayUncle is bringing a “certain change to the mindset” of the public. “But, hotels don’t want to announce that they are open to unmarried couples,” the hotelier explained. “Sometimes, we face resistance from staff who question why we are allowing unmarried couples. But the fact is, it is not illegal.” 
   
   Risky business, but sustainable 
   
   Currently, StayUncle works on a commission basis, which varies from hotel to hotel. 
   
   “We don’t want to scale up massively by offering cheap discounts. That is not a viable and sustainable business model,” said the 26-year-old Sethi. “In the long run, it will not work. So we would rather focus on growing slowly.” 
   
   A large number of India’s e-commerce players and budget hotel-booking companies have relied on massive discounts to scale up business. But that model has come in for heavy criticism for bleeding investor wealth. 
   
   An eight-hour stay at hotels that are listed on StayUncle costs anywhere between Rs1,400 ($21) and Rs5,000 ($75). The average rates, however, is around Rs2,000 ($30) for an eight-hour stay. 
   
   Now, as StayUncle expands, it has another challenge: ensuring privacy. 
   
   In a country where hidden cameras have been found in the changing rooms of even upmarket designer stores, Sethi, and his team will have to ensure that his clients are safe. 
   
   “If you see, we currently only tie up with hotels that have a reputation and they would not allow something that puts their business at stake,” said Sethi. “Of course, I wouldn’t say the problem can be completely eliminated, but we know that these hotels we tie up with would never ever do it.” ||||| The U.S. Federal Bureau of Investigation (FBI) this week warned about a “dramatic” increase in so-called “CEO fraud,” e-mail scams in which the attacker spoofs a message from the boss and tricks someone at the organization into wiring funds to the fraudsters. The FBI estimates these scams have cost organizations more than $2.3 billion in losses over the past three years. 
   
   In an alert posted to its site, the FBI said that since January 2015, the agency has seen a 270 percent increase in identified victims and exposed losses from CEO scams. The alert noted that law enforcement globally has received complaints from victims in every U.S. state, and in at least 79 countries. 
   
   CEO fraud usually begins with the thieves either phishing an executive and gaining access to that individual’s inbox, or emailing employees from a look-alike domain name that is one or two letters off from the target company’s true domain name. For example, if the target company’s domain was “example.com” the thieves might register “examp1e.com” (substituting the letter “L” for the numeral 1) or “example.co,” and send messages from that domain. 
   
   Unlike traditional phishing scams, spoofed emails used in CEO fraud schemes rarely set off spam traps because these are targeted phishing scams that are not mass e-mailed. Also, the crooks behind them take the time to understand the target organization’s relationships, activities, interests and travel and/or purchasing plans. 
   
   They do this by scraping employee email addresses and other information from the target’s Web site to help make the missives more convincing. In the case where executives or employees have their inboxes compromised by the thieves, the crooks will scour the victim’s email correspondence for certain words that might reveal whether the company routinely deals with wire transfers — searching for messages with key words like “invoice,” “deposit” and “president.” 
   
   On the surface, business email compromise scams may seem unsophisticated relative to moneymaking schemes that involve complex malicious software, such as Dyre and ZeuS. But in many ways, CEO fraud is more versatile and adept at sidestepping basic security strategies used by banks and their customers to minimize risks associated with account takeovers. In traditional phishing scams, the attackers interact with the victim’s bank directly, but in the CEO scam the crooks trick the victim into doing that for them. 
   
   The FBI estimates that organizations victimized by CEO fraud attacks lose on average between $25,000 and $75,000. But some CEO fraud incidents over the past year have cost victim companies millions — if not tens of millions — of dollars. 
   
   Last month, the Associated Press wrote that toy maker Mattel lost $3 million in 2015 thanks to a CEO fraud phishing scam. In 2015, tech firm Ubiquiti disclosed in a quarterly financial report that it suffered a whopping $46.7 million hit because of a CEO fraud scam. In February 2015, email con artists made off with $17.2 million from The Scoular Co., an employee-owned commodities trader. More recently, I wrote about a slightly more complex CEO fraud scheme that incorporated a phony phone call from a phisher posing as an accountant at KPMG. 
   
   The FBI urges businesses to adopt two-step or two-factor authentication for email, where available, and to establish other communication channels — such as telephone calls — to verify significant transactions. Businesses are also advised to exercise restraint when publishing information about employee activities on their Web sites or through social media, as attackers perpetrating these schemes often will try to discover information about when executives at the targeted organization will be traveling or otherwise out of the office. 
   
   For an example of what some of these CEO fraud scams look like, check out this post from security education and awareness firm Phishme about scam artists trying to target the company’s leadership. 
   
   I’m always amazed when I hear security professionals I know and respect make comments suggesting that phishing and spam are solved problems. The right mix of blacklisting and email validation regimes like DKIM and SPF can block the vast majority of this junk, these experts argue. 
   
   But CEO fraud attacks succeed because they rely almost entirely on tricking employees into ignoring or sidestepping some very basic security precautions. Educating employees so that they are less likely to fall for these scams won’t block all social engineering attacks, but it should help. Remember, the attackers are constantly testing users’ security awareness. Organizations might as well be doing the same, using periodic tests to identify problematic users and to place additional security controls on those individuals. 
   
   Tags: ceo fraud, dkim, Dyre, fbi, phishme, spf, The Scoular Co., Ubiquiti, zeus
target: – A relatively new email scam is raking in millions of dollars, and it's got nothing to do with long-lost relatives in Nigeria. Instead, as Quartz explains, the "CEO Email Scam" dupes employees into wiring money by using bogus messages from the boss. The scammers do their homework: They assume the identity of a company CEO, or sometimes simply send an email so close to the correct email that the recipient never notices the difference. The requests go to someone in the company authorized to deal with money, usually demanding quick action—and confidentiality—because of a pending business deal. It's been so successful that the FBI issued an alert last week, citing complaints in every state and in 79 countries. "On the surface, business email compromise scams may seem unsophisticated relative to moneymaking schemes that involve complex malicious software," writes Brian Krebs of Krebs on Security. But the CEO scam is especially effective because of one crucial factor: "In traditional phishing scams, the attackers interact with the victim’s bank directly, but in the CEO scam the crooks trick the victim into doing that for them." When it works, a typical haul is between $25,000 and $75,000. The known haul worldwide is $2.3 billion, says the FBI. One cybersecurity expert in France warns that it won't go away any time soon. "It will spread because it's too good to be ignored," he tells the BBC.