New E-Mail Phishing Scheme Targeting Large Organizations Exposed

phishing scheme

Since a lot of phishing schemes are exposed every now and then by IRS and other concerned government departments, hackers, and cyber criminals are finding new and innovative ways of committing fraud. The latest phishing scheme, which is specially targeted towards large organization, works something like this:

One of the employees responsible for finances in the organization receives an email from higher management directing them to immediately wire funds to a certain client for their services. The employee will release the funds normally without any doubt. Eide Bailey, one of the most reputed tax accountant and CPA firms, admits several cases has been reported where the email recipients have routinely processed the funds to the hacker’s account without any uncertainty or hesitation.

However, you will be thinking how the perpetrators are able to create an email ID of the organization and that to of a higher management and supervisors. The truth is hackers are clever and smart enough to successfully exploit the power of Typoglycemia, which was recently neologized by the Cambridge University.  The study says that the mind will be able to read the words as long as the first and last letters remain the same. The cybercriminals have used this trick to their fullest potential in order to commit the employees in transferring the funds without an iota of doubt.

Accordingly, they create an email ID, which resembles to be a legitimate one, but upon the closer review, the email address will have one different single character and the font will be changed to make it appear to look similar. In addition, the email will have the same signature, organization logos and contact information to ensure that the employees are committed to releasing the funds to their accounts.

Below is an appropriate example from Eide Baily:

Real@eidebailly.com vs. Fake@eidebailIy.com

The first web address is undoubtedly correct but the second web address is the fake one wherein the last L character has been deliberately changed to I. Even the font has been changed to hide the character change and believe me or not, it appears real and legitimate email address. This is how they are able to commit the fraud and get away with a large amount of money.

How to Recognize Phishing Email Messages

  • Email address will be slightly different. Check carefully for any character change or an extra letter
  • Signature will be different from the standard signature of the organization
  • There will be misspelling and typos in the body of the email
  • There will be a request to release the fund “immediately” or “urgent”
  • There will be request to provide sensitive information such as usernames, account numbers, and passwords

Tips for Protecting your Organization

  • Immediately educate your employees especially accounting and technology department about this phishing scam
  • Revise the procedures and policies about releasing the payments for any management officials whether it is CEO, CFO, CMO or CTO
  • Any email with urgent payment release request should be verified with higher officials
  • Create a double verification process for releasing payments for new vendors
  • Verify the department by calling them over the phone. Don’t use the phone number furnished in the email, instead, search your organization’s directory
  • Create a filter to flag the emails, which arrive from outside of the network
  • Any payment releasing request should be verified from higher management via email. Don’t reply to the same email, instead, send a new email
  • Change the default email system fonts so that there should be clear difference between every character
  • Notify the IT or concerned department if you receive any suspicious emails

CheckMark encourages you to proceed cautiously when you receive any suspicious emails from external networks. The above-mentioned simple steps will not only reduce the risk of falling victim to a number of different phishing scams but also helps the organization from losing money. In case, if you have been a victim of a phishing scam, notify your bank and contact your local police immediately.

Lately, IRS warned of a new email phishing scheme falsely claiming to be from the taxpayer advocate service, which is a legitimate organization working under IRS to help taxpayers resolve their federal tax issues. The email contained false case number and the recipients were persuaded to click the links in the email and solicit their personal information. Here a list of dozen scams highlighted by IRS way back in 2014.

As a reputed solution provider in the world of finance technology (FinTech), CheckMark always ensures our applications and software are invulnerable and safe from any kind of data hack or cyber-attacks. We feel it’s our moral responsibility to make organizations aware of current phishing schemes that could target them any day if they are unprepared.