This week, MacEwan University in Canada lost $9.5million due to a spear phishing attack. A write up by the BBC explained that, “fraudulent emails convinced staff at MacEwan University that one of its clients was changing its bank account details. Staff then paid money into the fraudulently created account”.
In response to this, Levine, former CISO for two Fortune 500 companies, and current Security Advisor to Wombat Security Technologies commented below.
Alan Levine, Security Advisor at Wombat Security Technologies:
“The kind of scam that victimized MacEwan University is becoming all too prevalent, and the impact can be hugely significant both in terms of money and in terms of trust in internal and supplier processes. Unfortunately, in the case of wire transfers for account payments, typically the payee has no more than 24 hours to claw back the transfer; after that, it’s an attacker win in most cases. Everyone else loses: The affected organization loses financially, and it also suffers a loss of confidence among its suppliers who rightly expect timely, full payments. Thus, it’s imperative that organizations understand this kind of scam and implement procedures to guard against it.
The reason scams like this succeed is because organizations rely on email as the primary vector for customer/supplier communications. And, even though one may know, based on the prevalence of publicized cyber incidents in the press, that one should trust email less and question more, email remains the naturally predominant vehicle for business communications. When a supplier makes a request in an email, the customer responds in an email, and so on and so on. The communication chain is thereby limited to that email cocoon, and wrongly so. For inarguably, when an email communicates a message with the gravity of a request to change supplier receivables bank account details, that should instantly raise one’s antennae. Smart internal procedures should automatically kick into gear.
These procedures should require confirmation outside of email, outside of the communication chain the attacker wants most to stay within. Best practice would be to call the supplier for confirmation of the request. No, not to call whatever phone number might be indicated within the email chain — that’s just an extension of the scam; if you don’t trust the email, then definitely don’t trust details within the email, including phone contact details that might display in a signature line. Instead, call one’s regular contact at the supplier, or else call the supplier’s main switchboard number and ask for the accounts receivable or treasury function. Then, ask for the request to be relayed by regular paper mail. And, also require that the supplier requesting a bank account change knows something in detail about their current bank account of record — the last 4 digits of the routing and account numbers, for example.
Attacks like the one against MacEwan University are prevalent, but they are also targeted. The attacker does his research first, identifying the target and likely suppliers, understanding payment processes and establishing offshore landings for the hoped-for wires. In some cases, the attacker may first target an organization’s suppliers directly, to learn who they supply to and even to determine exact amounts billed to or owed by the customer. Given the attacker may go to these lengths to launch their scheme, every organization should be on alert, take simple precautions, work out-of-email-band to confirm any request as serious as a bank account change, and then double check every detail before pressing the enter key.”
