Identifying vendor email fraud to help protect your business

In today's increasingly interconnected and digital world, businesses are vulnerable to the threat of Business Email Compromise (BEC) scams. This common type of B2B payment and business fraud exploits the trust businesses place in reputable entities by cybercriminals who impersonate them, deceiving victims into transferring funds through wire transfers, automated clearing houses (ACH), or checks to fraudulent accounts.

Donny Hoye, a senior vice president at Capital One who leads the treasury sales team, adds that “victims involved in vendor BEC scams are tricked into believing they are engaged in legitimate business transactions with trusted contacts, only to discover later that the vendor’s email was hacked after the fact.” The aftermath can be devastating, resulting in substantial financial loss. This article will help you understand BEC scams, identify warning signs and implement preventive measures to help protect you and your company from cybercrime.

Vendor email compromise (VEC) scams are highly-sophisticated schemes employed by cybercriminals who deceive individuals and businesses through email communication. During a VEC scam, fraudsters masquerade as trusted entities, such as executives or financial institutions, to trick victims into performing unauthorized fund transfers. 

Cybercriminals can use one of several strategies to deceive victims and gain unauthorized access to their funds and sensitive information. According to Hoye, “It’s critical to stay ahead of fraudsters—they are getting sophisticated in their tactics every day, so it's important that teams implement regular training and strict policies to quickly spot and report potential scams before they become a major problem.”

The most common BEC tactics are listed below.

BEC scams have become increasingly common in recent years. The number of reports and accompanying losses has also increased. The following statistics from the FBI's Internet Crime Complaint Center (IC3) report shed light on the magnitude of this issue.

• The financial losses attributed to BEC scams reached $1.8 billion in 2020, marking a significant increase from $263 million in 2015. This represents a 584% increase over that period.
• The cumulative losses from BEC scams between 2018 and 2020 exceeded $4.9 billion, demonstrating the persistent and escalating threat posed by these scams. 

Identifying and reporting signs of VEC scams are critical steps in mitigating possible financial loss and helping to protect your business from online crime. Stay alert and report suspicious activity immediately to help safeguard your business from the financial damage caused by these scams.

Below, we’ve provided ways to identify and report suspicious activity.

Here are characteristics to look for when identifying VEC scams:

• Misspelled or unnecessary characters in the email address
• Strange phrases, syntax, fonts, or date formats
• Signs of email manipulation or alteration
• Discrepancies in communication platforms and email addresses
• Last-minute changes in payment instructions or recipient details
• Unexplained urgency in payment requests
• Requests for email-only communication
• Requests for advance payment or changes in direct deposit

Here are options for reporting VEC scams:

• File a complaint with the FBI’s Internet Crime Complaint Center
• Contact your relationship manager at Capital One
• Report the incident to abuse@capitalone.com for further investigation

Hoye adds to “look for anything that changes how vendor payments are being made compared with past payments (e.g., new payment method, changing the name of the company they are remitting payment to, changing the contact person at the vendor company) as a critical first step.”

By taking the proper precautions before and after accepting payment requests, individuals and companies can stay vigilant and help reduce their risk of becoming fraud victims. Consider the recommendations below to help protect against BEC scams.

Here are a few ways to help manage vendor payments:

Setup recommendations: ✔Implement dual approval requirements, both for adding users and for making payments. ✔ Limit number of authorized individuals for fund transfers. ✔ Establish intrusion detection rules for identifying suspicious email addresses. ✔ Set up callback thresholds and information verification with trusted sources.

Managing payment requests: ✔ Perform callbacks to known client/vendor numbers, not those provided in the request. Do not use the phone number on the email itself. ✔ Scrutinize incoming materials (emails, links, and attachments) especially those involving new payment instructions. ✔ Obtain secondary sign-off for any changes to payment requests. ✔ Establish firm policies and procedures with the entire team. Ensure regular meetings include updated procedure.

 

There is no shortcut to payment security. Although users commonly rely on payment methods like ACH to combat potential VEC or BEC scams, Hoye warns that these payments are not necessarily as secure as they are commonly thought to be. “Stop putting so much faith in ACH fraud protections—they are only as perfect as the people handling them,” he said. Capital One recommends this summary for more information on what ACH payments are and how they work before making any transactions.

“There is no perfect tool capable of stopping all instances of fraud,” Hoye concludes. Capital One’s trusted professionals, however, are trained in helping report VEC scams when they occur. In doing so, they help business owners take strong action to combat cybercrimes more effectively.

If you are a Capital One business customer and suspect you have become a victim of BEC or VEC fraud, it is critical to take action. Contact your relationship manager at Capital One and report the incident immediately.