Electronic Fund Transfer (EFT) Scams: 3 Risk Mitigation Tactics
Published:
September 25, 2023
Author(s):
There’s a new scam on the web: Electronic Fund Transfer (EFT) scams. Most are familiar with established scams like phishing and ransomware and the damage they can cause. These and other types of fraud and cybercrime are rampant: reported fraud and cybercrime accounted for $530M in victim losses in 2022 and increased by nearly 40% over 2021 – “historic levels” – according to the Canadian Anti-Fraud Centre. And since only 5% to 10% of fraud is actually reported the numbers are most definitely much higher. The risks of EFT scams are equally great. Here’s a breakdown of the two EFT scams we’re seeing, the risks they entail and three tactics you can implement to help mitigate those risks.
The Scams
Two EFT scams we’re seeing a lot of (or variations of them) right now are:
1. The “Our Payment Information Has Changed” Scam
What happened? You do a big deal with a long-standing customer. As usual, you ship the product. And as usual, you emailed the invoice to your customer. But this time, your customer doesn’t pay. So, you call your customer contact … who tells you they paid the invoice weeks ago with an EFT according to the new payment instructions your CFO emailed to them. Except you don’t have new payment instructions. And your CFO never emailed out any new payment instructions.
How’d it Happen? A hacker got into your email system and lurked there, watching your email exchanges, waiting for an opportunity. When they saw your email exchanges about the big deal, they watched for you to email the invoice. Then they emailed the customer from your – legitimate – email address and told them the EFT payment instructions had changed, providing a new one so they received the payment. Or, in a variation on this, the hacker used a domain name (for example, finance@c0mpany.com) easily confused with yours (finance@company.com) to send the payment instruction changes so their email appears legitimate; the recipient doesn’t notice and misdirects the funds to the hacker.
2. The Online Banking System Scam
What happened? You make new banking arrangements with your long-time financial institution. At some point, you notice that large sums of money have been e-transferred from your account to a number of recipients. But you don’t know who they are. And you’ve never sent an EFT.
How’d it Happen? A hacker got into the CFO’s computer (perhaps via a phishing scam) and installed a “remote access trojan”. The hacker then logged into your online banking program – as if they were you sitting at your keyboard – and e-transferred the funds to someone. The two-factor authentication to confirm via email didn’t help: the hacker controlled the CFO’s email.
The Risks
There are both obvious and not so obvious risks to all sides in each of these EFT scams.
Financial Loss. This is the most obvious risk: the victim – whomever is out the money – loses it. And unless you figure it out and act fast enough, there’s a good chance it’s gone for good. And we’re often not talking small potatoes; the amounts can be significant, ranging from thousands to hundreds of thousands. And really, there’s no limit.
Litigation. Since it’s unlikely the victim – whomever is out of the money – will be able to recover the money from the hacker or recover it before it leaves the fraudulent account, they’ll have no alternative but to sue any others involved to try to recover their loss. That could be, for example, a customer, a supplier, or a financial institution. The lack of clear direction from the courts means that everyone involved has a risk of liability. But win or lose, it’s a time-consuming and costly process in terms of money, time and reputation.
Relationship Damage. If you sue a supplier or customer with which you have a long-standing, solid relationship, you’ll have to figure in the cost of damage to that relationship. For example, if you’re a supplier and you sue a good customer, chances are high that customer won’t be purchasing from you in the future.
Liability. If you’re the one getting sued, you’ll incur the time and cost of litigation regardless of the outcome – but if you lose, you’ll also incur liability for the financial loss.
The Risk Mitigation Tactics
It’s impossible to eliminate completely the risks of EFT scams. And you must ensure you have the necessary cyber-security and privacy systems and breach mitigation plans in place, and investigate with your insurer available insurance coverage for EFT fraud. But there are a few simple tactics you can implement to help mitigate the risks of EFT scams affecting your organization.
Stay Suspicious. Never, ever take an email about an EFT at face value. One – perhaps the main – reason these scams succeed is because the hackers are using an actual legitimate email address or one that appears legit. This distinguishes some of these scams from more routine phishing scams, where a quick glance at the email address and contents can give the scam away. But falling for a phishing email could give a hacker access into your computer system and lead to an EFT scan.
Communicate Clearly. If you receive EFTs, make it very clear to everyone that you will never change your payment instructions or your banking information by an email (and of course, don’t). You can give them this message verbally, and you can also regularly reinforce it with an alert to this effect on the bottom of all emails, your invoices, and on the form on which you provide your electronic payment information to another party. Put them all on notice that they should not act on any email purporting to change your banking information without additional diligence.
Verify by Phone. If you send EFTs, implement a policy to verify the banking information with a telephone call, ideally to a known contact at the recipient, before you hit send. Look up the business, call the main number – never the phone number in the email signature block – and ask to be transferred to the correct person. Similarly, second factor authentication for your bank accounts should never rely on the same means of communication or device that’s used to initiate an EFT. You want to be sure that even if a hacker can initiate the transfer from a hacked device, they can’t also confirm it.
Please contact your McInnes Cooper lawyer or any member of our Privacy, Data Protection & Cyber Security Team @ McInnes Cooper to discuss how you can mitigate the risks of EFT fraud.
Related Lawyers
Related Services
Related Industries
McInnes Cooper has prepared this document for information only; it is not intended to be legal advice. You should consult McInnes Cooper about your unique circumstances before acting on this information. McInnes Cooper excludes all liability for anything contained in this document and any use you make of it.
© McInnes Cooper, 2023. All rights reserved. McInnes Cooper owns the copyright in this document. You may reproduce and distribute this document in its entirety as long as you do not alter the form or the content and you give McInnes Cooper credit for it. You must obtain McInnes Cooper’s consent for any other form of reproduction or distribution. Email us at [email protected] to request our consent.
