The new frontier of email fraud 

How does the “Boss Email Fraud” attack work?

Email fraud is not new. However, hackers are becoming increasingly sophisticated in their approach.

10 years ago, you may have received an email from a “prince” or “long lost relative” saying you have just inherited a large sum of money.

A few years ago, a scammer may just try to trick an employee with a generic email pretending to be a service provider such as a courier, government or general enquiry. The email itself may have been generic and included spelling mistakes and incorrect names.

Today, however, the landscape is very different making it hard for employees to instantly spot a scam.

Here’s how the new email fraud works:

1. The attacker finds out the name and email address of a manager or executive in a company. As well as identifies a potential employee victim.
2. They then create a fake email account that looks like the manager’s email address (for example, by using a similar domain name and the same naming convention as the company).
3. Next, they will send an email to an employee in the company, pretending to be the manager. The email might ask the employee to do something like transfer money to a certain account, or provide sensitive information like passwords or company secrets. The email is often well written using correct English and industry terminologies. Often, the email will also appear to be part of an email chain between the manager and an external party. This makes the employee believe it is legit.
4. The employee, thinking they are following orders from their boss, complies with the request.

The attacker then uses the information or money obtained to commit fraud or theft.