Download

Fraudsters are increasingly taking advantage of the disruption caused by COVID-19 to target businesses. The most common type of scam involves the attacker impersonating one of your suppliers, which will normally look something like this: If you ever receive an email asking for a payment to be sent to a new bank account, contact the sender via telephone to verify the request. It’s important to be aware that fraudsters: Will make the email look like it has been sent from a known contact or supplier Can make it look like the request is replying to an earlier email Try to make the attempt look as normal as possible – e.g. expected value, normal timing, genuine invoice numbers, etc. Best practice advice: Always call a known telephone number; do not use any numbers given in the email Ensure that two employees check any payment being sent to a new beneficiary Be particularly wary of requests to send a payment to an account held in a different name, or located in a different country The pandemic is already causing significant challenges for businesses; by following the guidelines above, you can help ensure that fraud does not add to the burden. For further resources, please visit our Fraud Prevention webpage. To access the full infographic, Download PDF

Fraudsters are increasingly taking advantage of the disruption caused by COVID-19 to target businesses. The most common type of scam involves the attacker impersonating one of your suppliers, which will normally look something like this:
<img style="display: block; margin-left: auto; margin-right: auto;" src="https://www.citibank.com/commercialbank/solutions/fraud-prevention/assets/img/icons/email.jpg" width="653" height="466" />
If you ever receive an email asking for a payment to be sent to a new bank account, contact the sender via telephone to verify the request. It&rsquo;s important to be aware that fraudsters:
<ul>
<li>Will make the email look like it has been sent from a known contact or supplier</li>
<li>Can make it look like the request is replying to an earlier email</li>
<li>Try to make the attempt look as normal as possible &ndash; e.g. expected value, normal timing, genuine invoice numbers, etc. </li>
</ul>
<img style="display: block; margin-left: auto; margin-right: auto;" src="https://www.citibank.com/commercialbank/solutions/fraud-prevention/assets/img/icons/icon-set.jpg" width="762" height="113" /> 
<h4 class="text-cyan" style="box-sizing: border-box; margin-top: 0px; margin-bottom: 15px; font-weight: lighter; width: 1110px; text-align: left; background- line-height: 1.2em; font-size: 1.625rem;">Best practice advice:</h4>
<div class="mb-15" style="box-sizing: border-box; font-size: 16px; text-align: left;">
<div class="row row-eq-height" style="box-sizing: border-box; display: flex; flex: 1 0 100%; flex-wrap: wrap; margin-right: -15px; margin-left: -15px;">
<div class="col-md-12 col-12" style="box-sizing: border-box; position: relative; width: 1140px; padding-right: 15px; padding-left: 15px; flex: 0 0 100%; max-width: 100%; display: flex; flex-direction: column; margin-right: -0.25px; margin-left: -0.25px;">
<ul>
<li>Always call a known telephone number; do not use any numbers given in the email</li>
<li>Ensure that two employees check any payment being sent to a new beneficiary</li>
<li>Be particularly wary of requests to send a payment to an account held in a different name, or located in a different country</li>
</ul>
The pandemic is already causing significant challenges for businesses; by following the guidelines above, you can help ensure that fraud does not add to the burden. For further resources, please visit our Fraud Prevention <a class="text-cyan" style="box-sizing: border-box;" href="https://www.citibank.com/commercialbank/solutions/fraud-prevention/en/" target="_blank" rel="noopener">webpage</a>.
</div>
</div>
</div>
To access the full infographic,&nbsp;<a style="box-sizing: border-box;" href="https://www.citibank.com/commercialbank/solutions/fraud-prevention/assets/pdf/bec-fraud.pdf" target="_blank" rel="noopener">Download PDF</a>

Fraudsters are increasingly taking advantage of the disruption caused by COVID-19 to target businesses. Learn what a typical email attack might look like.

This is what fraud looks like

The COVID-19 crisis abruptly changed how businesses operate. Tasks previously done in a controlled workplace setting shifted to employees’ homes. Workers were asked to do more with less, or change their job scope completely. Entire supply chains needed to be reshaped due to disruptions around the globe. In the midst of this stressful environment, criminals have found a golden opportunity. Fraudsters had already been increasing the frequency of their attempts in the past few years, but the unprecedented disruption has emboldened them. In the US, by the end of May, 2020, the Internet Crime Complaint Center had received nearly the same number of complaints in 2020 as for all of 2019 ; in the UK, fraud rates for financial products (for both businesses and retail) increased by 33% in April.2 The good news is that companies can curb these fast-growing types of fraud with simple measures and careful planning. THE RISK Why Business Email Compromise is growing Between 2013 and 2019, losses from international business email compromise (BEC) schemes totaled more than $26 billion.3 BEC accounted for half of the cyber-crime losses in 2019, resulting in an average loss of almost $75,000.4 The latest AFP survey shows 75% of American businesses experienced a BEC attempt last year.5 BEC is a broad term that covers any scenario where the fraudster sends an emailed request for a payment to be sent to a new beneficiary. BEC began with impersonation of C-suite executives and has since expanded to the supply chain. Most recently, there have been spike in BEC on M&A transactions, with the seller impersonated by criminals. To add credibility, the group often sends a separate supporting email purporting to come from a well-known law firm. Supplier impersonation has proved successful because it is harder to contact people in a different organization to verify a request. Moreover, these scams often reference a genuine transaction, so the request details appear genuine, reinforcing its credibility. COVID-19 has created opportunities for new forms of supplier impersonation and exacerbated risks for a number of reasons: Criminals have a realistic reason, such as lockdown restrictions or cash flow problems, to ask for the payment to be sent to another bank account. Many scams work by putting their victims under pressure. COVID-19 provides a useful context to accelerate payments. Remote working gives criminals a justification for using a different email address. With teams working remotely, individuals may be less attentive compared to working in a normal office environment. Conditions are ideal for increased procurement fraud The lockdown has increased demand and scarcity in certain goods or services, creating an opportunity for procurement fraud. The most obvious examples are personal protective equipment (PPE) – such as face masks and hand sanitizer – but there have been shortages of many goods. Fraudsters worldwide have exploited this situation, by promising to supply key goods at reduced prices or with expedited delivery. Procurement fraud, already a major problem for companies – representing 19% of all fraud incidents6 – has boomed in recent months. These scams normally involve the victim making a large down payment to secure goods; the items never arrive, or cheap counterfeits are delivered. There are several variations of this scheme, with the fraudsters impersonating large/respected suppliers, or acting as brokers or intermediaries offering goods. Firms may be procuring goods that they are unfamiliar with, such as PPE, or have to fill supply chain gaps at short notice in unfamiliar markets (China came out of lockdown when much of Europe and North American remained closed; many companies found themselves working with new counterparties as a result). Given the pressure on companies to continue to provide services to their customers, they can be vulnerable to fraud. In unusual circumstances, some employees may fail to take the time to ascertain who they are liaising with, or respond to cold calls or unsolicited emails without sufficient caution. Remote working raises the risk of insider fraud Many companies do not like to face the uncomfortable reality of insider fraud – as it involves work colleagues, or employees they may have hired. However, insider fraud is an increasing problem: 37% of economic fraud results from an internal perpetrator, while a further 20% is the result of collusion between internal and external parties.7 In total, almost six in ten of all fraud cases involves an internal party. The current environment increases the risk of employee fraud in three principal ways: Employees are performing higher risk activities remotely to keep businesses operating. Often, proper risk assessments were not carried out given the need to switch to remote working rapidly. Employee motivation may have increased. COVID-19 will have a severe financial impact on many people. In desperate times, some people are prepared to take desperate measures. Much insider fraud is opportunistic. Remote working creates new opportunities for this. As businesses adapt to survive – including letting employees go, or asking people to work longer hours – people may feel unfairly treated. Employees can use their grievances to justify/rationalize unethical behavior. THE RESPONSE Tackling increased fraud risk in the ‘new normal’ Many of the most effective ways to address supplier impersonation, procurement fraud or insider fraud are surprisingly simple. Often, employees just need to pay greater attention to the task in hand or be more cautious when dealing with people they do not know, or using new payment details (the latter is rare among businesses as it is inconvenient and time consuming to contact stakeholders to inform them of a change). In relation to supplier impersonation/BEC, whenever new payment details are supplied over email, the best control is to telephone the sender to confirm the request. Often, people take an email at face value or ask for written confirmation through the same channel, making it susceptible to fraud. Instead, they should use an alternative channel, such as telephone, to verify the authenticity (dialing a recognized number rather than one provided in the original email). It is also valuable for a second person to look at any transaction. Humans make errors and fraudsters are highly skilled – they seek to put people under pressure to impair their judgment. Having a second person to check the details improves the chances of detection. More generally, education is important. While many people have an instinctive feel for what is wrong, training makes it easier to spot warning signs and take appropriate action. Similarly, the risk of procurement fraud can be reduced using basic due diligence measures and common sense: like most scams, if an offer seems too good to be true, it usually is. Employees need to understand who they are engaging with. The simplest way is to go online, research the company, its trading history and core offering. Employees should speak to the individual to test their product knowledge; a scammer will not have deep product insights. Employees should also be wary of unsolicited calls or emails and always take extra steps to verify people’s details. Companies should trust their employees when it comes to the risk of internal fraud. But they should not give them free reign. Dual payment approval is an important and easy measure to put in place. Standard processes such as segregation of duties and reconciliation can also be powerful tools to prevent fraud: if employees know there are checks in place, they are less likely to be tempted to commit fraud. Companies should also analyze their processes to identify high risk components that might be exploited by employees and build controls to eliminate vulnerabilities. Focus on the six ‘P’s It is an unfortunate truth that many businesses will be subject to fraud, so companies need to think ahead and consider how they would respond to these situations. The well-known adage – prior preparation and planning prevent poor performance – rings particularly true. If a company does not have a clear plan, it has to make important decisions in a stressful environment. Consequently, mistakes will often be made or delays may occur that increase the potential for fraud and financial loss. Almost all companies have business continuity plans; they need to approach fraud in the same methodical way, especially in the COVID-19 environment where it is no longer possible to raise queries in an office environment. Employees need to know how to react when they are suspicious and who to tell. And, if a loss ever occurs, they must let their bank know as quickly as possible so that attempts can be made to recover funds. 1 https://www.fbi.gov/news/testimony/covid-19-fraud-law-enforcementsresponse-to-those-exploiting-the-pandemic 2 https://www.experianplc.com/media/news/2020/fraud-rate-rises-33-duringcovid-19-lockdown/ 3 https://www.fbi.gov/news/stories/operation-rewired-bec-takedown-091019 4 https://www.zdnet.com/article/fbi-bec-scams-accounted-for-half-of-the-cybercrime-losses-in-2019/ 5 https://www.jpmorgan.com/content/dam/jpm/commercial-banking/documents/fraud-protection/afp-fraud-survey-2020-report-highlights.pdf 6 https://www.pwc.com/gx/en/forensics/gecs-2020/pdf/global-economic-crimeand-fraud-survey-2020.pdf 7 https://www.pwc.com/gx/en/forensics/gecs-2020/pdf/global-economic-crimeand-fraud-survey-2020.pdf

The COVID-19 crisis abruptly changed how businesses operate. Tasks previously done in a controlled workplace setting shifted to employees&rsquo; homes. Workers were asked to do more with less, or change their job scope completely. Entire supply chains needed to be reshaped due to disruptions around the globe.
In the midst of this stressful environment, criminals have found a golden opportunity. Fraudsters had already been increasing the frequency of their attempts in the past few years, but the unprecedented disruption has emboldened them. In the US, by the end of May, 2020, the Internet Crime Complaint Center had received nearly the same number of complaints in 2020 as for all of 2019 ; in the UK, fraud rates for financial products (for both businesses and retail) increased by 33% in April.2 The good news is that companies can curb these fast-growing types of fraud with simple measures and careful planning.
<h4>THE RISK</h4>
Why Business Email Compromise is growing Between 2013 and 2019, losses from international business email compromise (BEC) schemes totaled more than $26 billion.3 BEC accounted for half of the cyber-crime losses in 2019, resulting in an average loss of almost $75,000.4 The latest AFP survey shows 75% of American businesses experienced a BEC attempt last year.5
BEC is a broad term that covers any scenario where the fraudster sends an emailed request for a payment to be sent to a new beneficiary. BEC began with impersonation of C-suite executives and has since expanded to the supply chain. Most recently, there have been spike in BEC on M&amp;A transactions, with the seller impersonated by criminals. To add credibility, the group often sends a separate supporting email purporting to come from a well-known law firm.
Supplier impersonation has proved successful because it is harder to contact people in a different organization to verify a request. Moreover, these scams often reference a genuine transaction, so the request details appear genuine, reinforcing its credibility.
COVID-19 has created opportunities for new forms of supplier impersonation and exacerbated risks for a number of reasons:
<ol>
<li>Criminals have a realistic reason, such as lockdown restrictions or cash flow problems, to ask for the payment to be sent to another bank account.</li>
<li>Many scams work by putting their victims under pressure. COVID-19 provides a useful context to accelerate payments.</li>
<li>Remote working gives criminals a justification for using a different email address.</li>
<li>With teams working remotely, individuals may be less attentive compared to working in a normal office environment.</li>
</ol>
Conditions are ideal for increased procurement fraud
The lockdown has increased demand and scarcity in certain goods or services, creating an opportunity for procurement fraud. The most obvious examples are personal protective equipment (PPE) &ndash; such as face masks and hand sanitizer &ndash; but there have been shortages of many goods.
Fraudsters worldwide have exploited this situation, by promising to supply key goods at reduced prices or with expedited delivery. Procurement fraud, already a major problem for companies &ndash; representing 19% of all fraud incidents6 &ndash; has boomed in recent months. These scams normally involve the victim making a large down payment to secure goods; the items never arrive, or cheap counterfeits are delivered.
There are several variations of this scheme, with the fraudsters impersonating large/respected suppliers, or acting as brokers or intermediaries offering goods. Firms may be procuring goods that they are unfamiliar with, such as PPE, or have to fill supply chain gaps at short notice in unfamiliar markets (China came out of lockdown when much of Europe and North American remained closed; many companies found themselves working with new counterparties as a result).
Given the pressure on companies to continue to provide services to their customers, they can be vulnerable to fraud. In unusual circumstances, some employees may fail to take the time to ascertain who they are liaising with, or respond to cold calls or unsolicited emails without sufficient caution.
Remote working raises the risk of insider fraud
Many companies do not like to face the uncomfortable reality of insider fraud &ndash; as it involves work colleagues, or employees they may have hired. However, insider fraud is an increasing problem: 37% of economic fraud results from an internal perpetrator, while a further 20% is the result of collusion between internal and external parties.7 In total, almost six in ten of all fraud cases involves an internal party.
The current environment increases the risk of employee fraud in three principal ways: Employees are performing higher risk activities remotely to keep businesses operating. Often, proper risk assessments were not carried out given the need to switch to remote working rapidly. Employee motivation may have increased. COVID-19 will have a severe financial impact on many people. In desperate times, some people are prepared to take desperate measures. Much insider fraud is opportunistic. Remote working creates new opportunities for this. As businesses adapt to survive &ndash; including letting employees go, or asking people to work longer hours &ndash; people may feel unfairly treated. Employees can use their grievances to justify/rationalize unethical behavior.
<h4>THE RESPONSE</h4>
 Tackling increased fraud risk in the &lsquo;new normal&rsquo;
Many of the most effective ways to address supplier impersonation, procurement fraud or insider fraud are surprisingly simple. Often, employees just need to pay greater attention to the task in hand or be more cautious when dealing with people they do not know, or using new payment details (the latter is rare among businesses as it is inconvenient and time consuming to contact stakeholders to inform them of a change).
In relation to supplier impersonation/BEC, whenever new payment details are supplied over email, the best control is to telephone the sender to confirm the request. Often, people take an email at face value or ask for written confirmation through the same channel, making it susceptible to fraud. Instead, they should use an alternative channel, such as telephone, to verify the authenticity (dialing a recognized number rather than one provided in the original email).
It is also valuable for a second person to look at any transaction. Humans make errors and fraudsters are highly skilled &ndash; they seek to put people under pressure to impair their judgment. Having a second person to check the details improves the chances of detection. More generally, education is important. While many people have an instinctive feel for what is wrong, training makes it easier to spot warning signs and take appropriate action.
Similarly, the risk of procurement fraud can be reduced using basic due diligence measures and common sense: like most scams, if an offer seems too good to be true, it usually is. Employees need to understand who they are engaging with. The simplest way is to go online, research the company, its trading history and core offering. Employees should speak to the individual to test their product knowledge; a scammer will not have deep product insights.
Employees should also be wary of unsolicited calls or emails and always take extra steps to verify people&rsquo;s details.
Companies should trust their employees when it comes to the risk of internal fraud. But they should not give them free reign. Dual payment approval is an important and easy measure to put in place. Standard processes such as segregation of duties and reconciliation can also be powerful tools to prevent fraud: if employees know there are checks in place, they are less likely to be tempted to commit fraud. Companies should also analyze their processes to identify high risk components that might be exploited by employees and build controls to eliminate vulnerabilities.
<div class="background-gray overflow-hidden pt-15 mt-15 mb-30" style="box-sizing: border-box; overflow: hidden; font-size: 16px; text-align: left; padding-top: 15px; margin-top: 15px; margin-bottom: 30px; background-color: #eeeeee;">
<div class="row" style="box-sizing: border-box; display: flex; flex: 1 0 100%; flex-wrap: wrap; margin-right: -15px; margin-left: -15px;">
<div class="col-12" style="box-sizing: border-box; position: relative; width: 1110px; padding-right: 15px; padding-left: 15px; flex: 0 0 100%; max-width: 100%;">
<h3 class="text-citi-blue" style="box-sizing: border-box; margin-top: 0px; margin-bottom: 15px; font-weight: lighter; width: 1080px; line-height: 1.2em; font-size: 1.625rem;">Focus on the six &lsquo;P&rsquo;s</h3>
<hr style="box-sizing: content-box; height: 0px; overflow: visible; margin-top: 15px; margin-bottom: 15px; border-width: 1px 0px 0px; border-color: #cccccc; border-top-style: solid;" /></div>
<div class="col-md-12 col-12" style="box-sizing: border-box; position: relative; width: 1110px; padding-right: 15px; padding-left: 15px; flex: 0 0 100%; max-width: 100%;">
It is an unfortunate truth that many businesses will be subject to fraud, so companies need to think ahead and consider how they would respond to these situations. The well-known adage &ndash; prior preparation and planning prevent poor performance &ndash; rings particularly true. If a company does not have a clear plan, it has to make important decisions in a stressful environment. Consequently, mistakes will often be made or delays may occur that increase the potential for fraud and financial loss.
Almost all companies have business continuity plans; they need to approach fraud in the same methodical way, especially in the COVID-19 environment where it is no longer possible to raise queries in an office environment. Employees need to know how to react when they are suspicious and who to tell. And, if a loss ever occurs, they must let their bank know as quickly as possible so that attempts can be made to recover funds.
</div>
</div>
</div>
1&nbsp;<a href="https://www.fbi.gov/news/testimony/covid-19-fraud-law-enforcementsresponse-to-those-exploiting-the-pandemic" target="_blank" rel="noopener">https://www.fbi.gov/news/testimony/covid-19-fraud-law-enforcementsresponse-to-those-exploiting-the-pandemic</a>
2&nbsp;<a href="https://www.experianplc.com/media/news/2020/fraud-rate-rises-33-duringcovid-19-lockdown/" target="_blank" rel="noopener">https://www.experianplc.com/media/news/2020/fraud-rate-rises-33-duringcovid-19-lockdown/</a>
3&nbsp;<a href="https://www.fbi.gov/news/stories/operation-rewired-bec-takedown-091019" target="_blank" rel="noopener">https://www.fbi.gov/news/stories/operation-rewired-bec-takedown-091019</a>
4&nbsp;<a href="https://www.zdnet.com/article/fbi-bec-scams-accounted-for-half-of-the-cybercrime-losses-in-2019/" target="_blank" rel="noopener">https://www.zdnet.com/article/fbi-bec-scams-accounted-for-half-of-the-cybercrime-losses-in-2019/</a>
5&nbsp;<a href="https://www.jpmorgan.com/content/dam/jpm/commercial-banking/documents/fraud-protection/afp-fraud-survey-2020-report-highlights.pdf" target="_blank" rel="noopener">https://www.jpmorgan.com/content/dam/jpm/commercial-banking/documents/fraud-protection/afp-fraud-survey-2020-report-highlights.pdf</a>
6&nbsp;<a href="https://www.pwc.com/gx/en/forensics/gecs-2020/pdf/global-economic-crimeand-fraud-survey-2020.pdf" target="_blank" rel="noopener">https://www.pwc.com/gx/en/forensics/gecs-2020/pdf/global-economic-crimeand-fraud-survey-2020.pdf</a>
7&nbsp;<a href="https://www.pwc.com/gx/en/forensics/gecs-2020/pdf/global-economic-crimeand-fraud-survey-2020.pdf" target="_blank" rel="noopener">https://www.pwc.com/gx/en/forensics/gecs-2020/pdf/global-economic-crimeand-fraud-survey-2020.pdf</a>

The COVID-19 crisis abruptly changed how businesses operate. Learn how these changes have altered the fraud risk landscape.

COVID-19 Has Increased Fraud Risk: How Should Companies Respond?

Working remotely from home offers undeniable perks — such as zero commute and a more flexible schedule. However, while every day may be casual Friday, one thing you can't take lightly is online security. If you're working from home temporarily or permanently, knowing how to protect yourself from cybercrime belongs at the top of your daily to-do list. You take steps to protect your personal information online, and your home office should be a priority, too. But first, you need to understand the most important steps to take — and the biggest security risks to watch out for — when working remotely. Working remotely can boost your fraud risk profile You may not think twice about logging on to your computer or mobile device for work, but doing so can put you at risk for fraud in more ways than one. That's because it's easier to hack people than machines, says Nic White, global fraud prevention head for Citi Commercial Bank. “Cybersecurity has improved significantly over recent years, so criminals are increasingly targeting people, tricking them into voluntarily handing over information or sending a payment to an unintended beneficiary,” White says. For example, White says one of the most popular tactics used by fraudsters is business email compromise (BEC) scams. These rely on the use of seemingly legitimate-looking emails to defraud remote workers and small business owners. BEC scam victims unknowingly send money transfers to criminals, believing the recipients are legitimate business contacts. If you find you're interfacing more with business contacts who are working out of the office, be especially watchful against BEC scams, as fraudsters might use the pretense of remote work as a reason you need to suddenly send payments or funds to a new and unfamiliar account. Click here to view the report in full.

Working remotely from home offers undeniable perks &mdash; such as zero commute and a more flexible schedule.
<hr />
However, while every day may be casual Friday, one thing you can't take lightly is online security.
If you're working from home temporarily or permanently, knowing how to protect yourself from cybercrime belongs at the top of your daily to-do list. You take steps to protect your personal information online, and your home office should be a priority, too.
But first, you need to understand the most important steps to take &mdash; and the biggest security risks to watch out for &mdash; when working remotely.
Working remotely can boost your fraud risk profile
You may not think twice about logging on to your computer or mobile device for work, but doing so can put you at risk for fraud in more ways than one.
That's because it's easier to hack people than machines, says Nic White, global fraud prevention head for Citi Commercial Bank.
&ldquo;Cybersecurity has improved significantly over recent years, so criminals are increasingly targeting people, tricking them into voluntarily handing over information or sending a payment to an unintended beneficiary,&rdquo; White says.
For example, White says one of the most popular tactics used by fraudsters is business email compromise (BEC) scams. These rely on the use of seemingly legitimate-looking emails to defraud remote workers and small business owners. BEC scam victims unknowingly send money transfers to criminals, believing the recipients are legitimate business contacts.
If you find you're interfacing more with business contacts who are working out of the office, be especially watchful against BEC scams, as fraudsters might use the pretense of remote work as a reason you need to suddenly send payments or funds to a new and unfamiliar account.
<a href="https://www.lifeandmoney.citi.com/money/finance-101/home-office-business-scams" target="_blank" rel="noopener">Click here to view the report in full. </a>

Working from home offers undeniable perks, but it can also introduce new fraud risks. Learn about the scams targeting remote workers.

Working Remotely? Be Aware of these Home Office Scams

We have all seen the figures placed on the cost of fraud and cyberattacks to businesses and the economy with the projected costs to reach $2 trillion by 2019.1 Less sensational than its financial implications, though, but far more disruptive, are the reputational damage and the business impact that arise in the aftermath of successful attacks. Protecting against the threats and attacks that fraud and cybersecurity pose is an ever-increasing concern for businesses today. For many, it has become imperative to safeguard their organisations from such dangers, especially considering that threats and attacks are continuing unabated as the methods of fraudsters and attackers evolve and change to reach their ends. Available data indicates that instances of fraud and cybersecurity attacks are increasing not just in frequency but in severity and impact. Companies that fail to ensure that their employees are fully trained to recognise and tack action against this using adequate security processes, procedures and protocols, therefore, not only face a greater risk of financial loss, which includes loss of assets, but a greater risk of reputational damage and business disruption, which includes negative publicity. How has the fraud landscape changed? Fraud and cybersecurity threats continue to evolve as better organised and more sophisticated attackers have emerged. As illustrated in diagram 1, fraudsters and cyber attackers have become much more sophisticated in recent years. There has been a noticeable shift in the profile of those behind attacks. In the past, attackers were primarily individuals operating on an opportunistic, casual or ad hoc basis, largely driven by the desire to prove that they could successfully carry out a fraud attack. Acting alone or in collusion to commit internal or external fraud, fraudsters increasingly perpetrate acts that are focused on disruption and destruction.

We have all seen the figures placed on the cost of fraud and cyberattacks to businesses and the economy with the projected costs to reach $2 trillion by 2019.1 Less sensational than its financial implications, though, but far more disruptive, are the reputational damage and the business impact that arise in the aftermath of successful attacks.
Protecting against the threats and attacks that fraud and cybersecurity pose is an ever-increasing concern for businesses today. For many, it has become imperative to safeguard their organisations from such dangers, especially considering that threats and attacks are continuing unabated as the methods of fraudsters and attackers evolve and change to reach their ends. 
Available data indicates that instances of fraud and cybersecurity attacks are increasing not just in frequency but in severity and impact. Companies that fail to ensure that their employees are fully trained to recognise and tack action against this using adequate security processes, procedures and protocols, therefore, not only face a greater risk of financial loss, which includes loss of assets, but a greater risk of reputational damage and business disruption, which includes negative publicity. 
How has the fraud landscape changed? 
Fraud and cybersecurity threats continue to evolve as better organised and more sophisticated attackers have emerged. As illustrated in diagram 1, fraudsters and cyber attackers have become much more sophisticated in recent years. There has been a noticeable shift in the profile of those behind attacks. 
<blockquote>
In the past, attackers were primarily individuals operating on an opportunistic, casual or ad hoc basis, largely driven by the desire to prove that they could successfully carry out a fraud attack. 
</blockquote>
Acting alone or in collusion to commit internal or external fraud, fraudsters increasingly perpetrate acts that are focused on disruption and destruction.
&nbsp;

Protecting against the threats and attacks that fraud and cybersecurity pose is an ever-increasing concern for businesses today. For many, it has become imperative to safeguard their organizations from such dangers.

An Overview of Fraud and Cybersecurity

What to do in the Event of Fraud Act Quickly Review and urgently determine if fraud has occurred; every minute may count. To report fraud, contact the following: Credit Card Fraud — Contact the number on the back of your card. Other types of fraud including ACH, CitiBusiness® Online, checks and wires — Contact your Citibank representative. Use the “F” Word Be prepared to state “fraud” — not “potential fraud” or similar as banks may not act on “potential” issues — and confirm this in writing/email. Alert Citi and/or Beneficiary Bank Immediately Citi will initiate recall actions. The shorter the time between a fraudulent transaction and detection, the greater the chance of recovery (ideally less than 48 hours, thereafter the prospect of recovery drops off dramatically). Provide the Details Beneficiary banks and others will need clear background information before they will act. Some jurisdictions make the recovery of misappropriated funds more difficult than others, so you may require further actions to recover your assets. For example, there may be legal restrictions on freezing/returning funds locally, or providing information on the identity of the beneficiary or remaining balance without a court/police order. There may also be certain processes that you, as the sender, may need to follow. Further Recommended Steps Reason/Example Engage internal fraud/security resources Bring in subject matter experts Report to local law enforcement as soon as possible — obtain a copy of the report or take a crime reference number Beneficiary banks may expect/ request this Independently review all recent transactions and logs for other suspect payments or unusual activity Look for other potentially fraudulent activity that may have occurred Independently secure your bank accounts to prevent further misuse For example, disable system users, implement payment exception approval process, etc Alert any other banks you may hold accounts with In case fraudsters attack other bank accounts Send an internal alert to increase awareness and vigilance In case of further contact/attempts, unless there is a concern of internal compromise Retain and hold any potential evidence for investigation Examples of evidence include email correspondence, audio logs, desktop PCs Consider appointing legal counsel, forensic consultants or private investigators to represent/assist you if necessary Some jurisdictions can be more difficult to navigate than others With your legal advisers’ direction, question employees carefully to seek verification of their activity and keep written records of responses. Ensure your employee’s recollection of events is accurate

What to do in the Event of Fraud
Act Quickly
<img style="float: left;" src="https://www.citivelocity.com/elemental/elemental.40c09bc4.svg" alt="" width="96" height="96" />
Review and urgently determine if fraud has occurred; every minute may count. To report fraud, contact the following: Credit Card Fraud &mdash; Contact the number on the back of your card. Other types of fraud including ACH, CitiBusiness&reg; Online, checks and wires &mdash; Contact your Citibank representative. 
Use the &ldquo;F&rdquo; Word
<img style="float: left;" src="https://www.citivelocity.com/elemental/elemental.40c09bc4.svg" alt="" width="96" height="96" />
&nbsp;
Be prepared to state &ldquo;fraud&rdquo; &mdash; not &ldquo;potential fraud&rdquo; or similar as banks may not act on &ldquo;potential&rdquo; issues &mdash; and confirm this in writing/email. 
&nbsp;
&nbsp;
Alert Citi and/or Beneficiary Bank Immediately
<img style="float: left;" src="https://www.citivelocity.com/elemental/elemental.40c09bc4.svg" alt="" width="96" height="96" /> Citi will initiate recall actions. The shorter the time between a fraudulent transaction and detection, the greater the chance of recovery (ideally less than 48 hours, thereafter the prospect of recovery drops off dramatically). 
&nbsp;
Provide the Details
Beneficiary banks and others will need clear background information before they will act. Some jurisdictions make the recovery of misappropriated funds more <img style="float: left;" src="https://www.citivelocity.com/elemental/elemental.40c09bc4.svg" alt="" width="91" height="91" /> difficult than others, so you may require further actions to recover your assets. For example, there may be legal restrictions on freezing/returning funds locally, or providing information on the identity of the beneficiary or remaining balance without a court/police order. There may also be certain processes that you, as the sender, may need to follow.
&nbsp;
<table class="MsoTable15Grid4" style="width: 100%; border-collapse: collapse; border: none; height: 502px;" border="1" cellspacing="0" cellpadding="0">
<tbody>
<tr style="height: 31px;">
<td style="width: 50%; border-top: 1pt solid black; border-bottom: 1pt solid black; border-left: 1pt solid black; border-image: initial; border-right: none; background: black; padding: 0in 5.4pt; height: 31px;" valign="top">
Further Recommended Steps
</td>
<td style="width: 50%; border-top: 1pt solid black; border-right: 1pt solid black; border-bottom: 1pt solid black; border-image: initial; border-left: none; background: black; padding: 0in 5.4pt; height: 31px;" valign="top">
Reason/Example
</td>
</tr>
<tr style="height: 47px;">
<td style="width: 50%; border-right: 1pt solid #666666; border-bottom: 1pt solid #666666; border-left: 1pt solid #666666; border-image: initial; border-top: none; background: #cccccc; padding: 0in 5.4pt; height: 47px;" valign="top">
Engage internal fraud/security resources
</td>
<td style="width: 50%; border-top: none; border-left: none; border-bottom: 1pt solid #666666; border-right: 1pt solid #666666; background: #cccccc; padding: 0in 5.4pt; height: 47px;" valign="top">
Bring in subject matter experts
</td>
</tr>
<tr style="height: 65px;">
<td style="width: 50%; border-right: 1pt solid #666666; border-bottom: 1pt solid #666666; border-left: 1pt solid #666666; border-image: initial; border-top: none; padding: 0in 5.4pt; height: 65px;" valign="top">
Report to local law enforcement as soon as possible &mdash; obtain a copy of the report or take a crime reference number
</td>
<td style="width: 50%; border-top: none; border-left: none; border-bottom: 1pt solid #666666; border-right: 1pt solid #666666; padding: 0in 5.4pt; height: 65px;" valign="top">
Beneficiary banks may expect/ request this
</td>
</tr>
<tr style="height: 50px;">
<td style="width: 50%; border-right: 1pt solid #666666; border-bottom: 1pt solid #666666; border-left: 1pt solid #666666; border-image: initial; border-top: none; background: #cccccc; padding: 0in 5.4pt; height: 50px;" valign="top">
Independently review all recent transactions and logs for other suspect payments or unusual activity
</td>
<td style="width: 50%; border-top: none; border-left: none; border-bottom: 1pt solid #666666; border-right: 1pt solid #666666; background: #cccccc; padding: 0in 5.4pt; height: 50px;" valign="top">
Look for other potentially fraudulent activity that may have occurred
</td>
</tr>
<tr style="height: 48px;">
<td style="width: 50%; border-right: 1pt solid #666666; border-bottom: 1pt solid #666666; border-left: 1pt solid #666666; border-image: initial; border-top: none; padding: 0in 5.4pt; height: 48px;" valign="top">
Independently secure your bank accounts to prevent further misuse
</td>
<td style="width: 50%; border-top: none; border-left: none; border-bottom: 1pt solid #666666; border-right: 1pt solid #666666; padding: 0in 5.4pt; height: 48px;" valign="top">
For example, disable system users, implement payment exception approval process, etc
</td>
</tr>
<tr style="height: 39px;">
<td style="width: 50%; border-right: 1pt solid #666666; border-bottom: 1pt solid #666666; border-left: 1pt solid #666666; border-image: initial; border-top: none; background: #cccccc; padding: 0in 5.4pt; height: 39px;" valign="top">
Alert any other banks you may hold accounts with
</td>
<td style="width: 50%; border-top: none; border-left: none; border-bottom: 1pt solid #666666; border-right: 1pt solid #666666; background: #cccccc; padding: 0in 5.4pt; height: 39px;" valign="top">
In case fraudsters attack other bank accounts
</td>
</tr>
<tr style="height: 43px;">
<td style="width: 50%; border-right: 1pt solid #666666; border-bottom: 1pt solid #666666; border-left: 1pt solid #666666; border-image: initial; border-top: none; padding: 0in 5.4pt; height: 43px;" valign="top">
Send an internal alert to increase awareness and vigilance
</td>
<td style="width: 50%; border-top: none; border-left: none; border-bottom: 1pt solid #666666; border-right: 1pt solid #666666; padding: 0in 5.4pt; height: 43px;" valign="top">
In case of further contact/attempts, unless there is a concern of internal compromise
</td>
</tr>
<tr style="height: 48px;">
<td style="width: 50%; border-right: 1pt solid #666666; border-bottom: 1pt solid #666666; border-left: 1pt solid #666666; border-image: initial; border-top: none; background: #cccccc; padding: 0in 5.4pt; height: 48px;" valign="top">
Retain and hold any potential evidence for investigation
</td>
<td style="width: 50%; border-top: none; border-left: none; border-bottom: 1pt solid #666666; border-right: 1pt solid #666666; background: #cccccc; padding: 0in 5.4pt; height: 48px;" valign="top">
Examples of evidence include email correspondence, audio logs, desktop PCs
</td>
</tr>
<tr style="height: 67px;">
<td style="width: 50%; border-right: 1pt solid #666666; border-bottom: 1pt solid #666666; border-left: 1pt solid #666666; border-image: initial; border-top: none; padding: 0in 5.4pt; height: 67px;" valign="top">
Consider appointing legal counsel, forensic consultants or private investigators to represent/assist you if necessary
</td>
<td style="width: 50%; border-top: none; border-left: none; border-bottom: 1pt solid #666666; border-right: 1pt solid #666666; padding: 0in 5.4pt; height: 67px;" valign="top">
Some jurisdictions can be more difficult to navigate than others
</td>
</tr>
<tr style="height: 64px;">
<td style="width: 50%; border-right: 1pt solid #666666; border-bottom: 1pt solid #666666; border-left: 1pt solid #666666; border-image: initial; border-top: none; background: #cccccc; padding: 0in 5.4pt; height: 64px;" valign="top">
With your legal advisers&rsquo; direction, question employees carefully to seek verification of their activity and keep written records of responses.
</td>
<td style="width: 50%; border-top: none; border-left: none; border-bottom: 1pt solid #666666; border-right: 1pt solid #666666; background: #cccccc; padding: 0in 5.4pt; height: 64px;" valign="top">
Ensure your employee&rsquo;s recollection of events is accurate
</td>
</tr>
</tbody>
</table>

Advice on steps to take in the event of suspected or actual fraud involving bank payments.

What to Do in the Event of Fraud

Guidance on How to Combat Fraud Warning Signs For email, letter and phone How do you know the email, letter or call you received requesting information or instructing a transaction is not fraudulent? Fraudsters exploit human psychology and other social engineering tactics in an attempt to commit fraud. Be vigilant: recognizing signs of fraud is the most effective way to combat it. Do’s and Don’ts For devices (smartphones, tablets, laptops and pcs) You may need to involve your IT department to effectively adopt these recommendations. This may require that you undergo a risk assessment in compliance with your IT department’s controls and evaluations. Risks and Controls For beneficiary change requests Recognizing the problem is the key to applying best practice solutions. These tips — when applied alongside your own internal control processes — will mitigate the risk involved in changing beneficiary’s payment details.

<h4>Guidance on How to Combat Fraud</h4>
&nbsp;
Warning Signs
&nbsp;
For email, letter and phone
How do you know the email, letter or call you received requesting
information or instructing a transaction is not fraudulent? Fraudsters
exploit human psychology and other social engineering tactics in an
attempt to commit fraud. Be vigilant: recognizing signs of fraud is the
most effective way to combat it.
&nbsp;
Do&rsquo;s and Don&rsquo;ts
&nbsp;
For devices (smartphones, tablets, laptops and pcs)
<div>
You may need to involve your IT department to effectively adopt these
recommendations. This may require that you undergo a risk assessment
in compliance with your IT department&rsquo;s controls and evaluations.
&nbsp;
<div>
Risks and Controls
&nbsp;
For beneficiary change requests
Recognizing the problem is the key to applying best practice solutions.
These tips &mdash; when applied alongside your own internal control
processes &mdash; will mitigate the risk involved in changing beneficiary&rsquo;s
payment details.
&nbsp;
</div>
</div>

Fraudsters exploit human psychology and other social engineering tactics in an attempt to commit fraud. Be vigilant: recognizing signs of fraud is the most effective way to combat it.

How to Combat Fraud

BEC Infographics

Look-alike and hacked emails are helping fraudsters steal billions of dollars. While awareness is growing, the scams are also evolving and there are a few common misconceptions that are leaving businesses vulnerable. For the last five years, companies around the world have been suffering from a fraud scheme known as a Business Email Compromise (BEC). The scam sees a cybercriminal pose as a known business contact and send a forged email requesting their victim to make a payment to a new beneficiary. While the attacks may sound simplistic, more than $12.5 billion in fraud losses have been attributed to this type of fraud globally,[i] making BEC the most lucrative form of cybercrime seen to date. During a typical BEC attack, a cybercriminal will use a hacked or look-alike email account to impersonate an Executive within your company or one of your existing suppliers. Before they send the email, the attacker will spend many months studying your business, so the timing, content and tone of the message will often appear normal. Because these types of attacks have been around for a few years, awareness of the scam has increased, and businesses have started to strengthen their defences. But as businesses have evolved, the scam has too, and fraudsters are changing their tactics to try to avoid detection. Here are three of the most common misconceptions about BEC, which are based upon earlier versions of the scam: Executive impersonation is the primary risk During the early years, most BEC cases involved the attacker impersonating a CEO, CFO or another internal Executive. While this threat has not completely gone away, the overwhelming majority of BEC cases now see the attacker pose as one of your existing suppliers. As you already make regular payments to your vendors, the attacker no longer has to convince their victim of the need for the payment, they simply need to create a good reason for the payment to be sent to a new bank account. The emails will be unsolicited and easy to spot Many people assume that a BEC attempt will arrive via a new email request, much like cold calling over the telephone. While this may previously have been true, the attackers now try to intercept and manipulate an existing email conversation, rather than initiating a fresh request. In the supply chain scenario, the attackers will hijack an email about an existing order (regularly after the down-payment has already been made) and then ask that their payment details be updated. The attackers will try to avoid prolonged dialogue In the Executive scenario, the fraudsters would often send a single payment request, together with a reason why they couldn’t be contacted – such as being in an important meeting or about to board a flight. These standalone (and normally ad-hoc) requests often looked suspicious and so the fraudsters have started to refine their approach. It is now common to see numerous emails between the fraudster and victim, which are designed to build rapport, develop the cover story and even create the opportunity for a second or third attempt. In the supplier scenario, we have even seen cases where the fraudster is having simultaneous conversations with both the supplier and buyer (in both cases impersonating the other party), which allows them to gather additional information, answer any questions and improve the credibility of the request. While the attacks have continued to evolve, the most effective controls to combat BEC have remained consistent. If you want to protect your business, there are three simple steps which will help reduce your susceptibility to an attack: Call Backs - If you ever receive an email requesting a payment to be sent to a new beneficiary, pick up the telephone and call the sender back to confirm the request. It’s important to use a previously known telephone number, rather than using any numbers that are given in the body/signature of the email. Dual Approval - Whenever you need to add a new payee, or change existing payment details, configure your systems to require an approver/checker. An extra set of eyes significantly improves your chances of spotting anything untoward. Training - Ensure your staff is aware of risk. Most people have naturally good instincts, but need to understand what BEC is, before they are able to look out for it. If you suspect you have fallen victim to BEC, contact your Citi Service Representative as quickly as possible so we can help to protect your account and attempt to recover any lost funds. Your security is our priority. Click here to see an infographic about BEC

Look-alike and hacked emails are helping fraudsters steal billions of dollars. While awareness is growing, the scams are also evolving and there are a few common misconceptions that are leaving businesses vulnerable. 
For the last five years, companies around the world have been suffering from a fraud scheme known as a Business Email Compromise (BEC). The scam sees a cybercriminal pose as a known business contact and send a forged email requesting their victim to make a payment to a new beneficiary. While the attacks may sound simplistic, more than $12.5 billion in fraud losses have been attributed to this type of fraud globally,[i] making BEC the most lucrative form of cybercrime seen to date.
 During a typical BEC attack, a cybercriminal will use a hacked or look-alike email account to impersonate an Executive within your company or one of your existing suppliers. Before they send the email, the attacker will spend many months studying your business, so the timing, content and tone of the message will often appear normal.
 Because these types of attacks have been around for a few years, awareness of the scam has increased, and businesses have started to strengthen their defences. But as businesses have evolved, the scam has too, and fraudsters are changing their tactics to try to avoid detection. Here are three of the most common misconceptions about BEC, which are based upon earlier versions of the scam:
<ol>
<li>Executive impersonation is the primary risk During the early years, most BEC cases involved the attacker impersonating a CEO, CFO or another internal Executive. While this threat has not completely gone away, the overwhelming majority of BEC cases now see the attacker pose as one of your existing suppliers. As you already make regular payments to your vendors, the attacker no longer has to convince their victim of the need for the payment, they simply need to create a good reason for the payment to be sent to a new bank account.</li>
<li>The emails will be unsolicited and easy to spot Many people assume that a BEC attempt will arrive via a new email request, much like cold calling over the telephone. While this may previously have been true, the attackers now try to intercept and manipulate an existing email conversation, rather than initiating a fresh request. In the supply chain scenario, the attackers will hijack an email about an existing order (regularly after the down-payment has already been made) and then ask that their payment details be updated. </li>
<li>The attackers will try to avoid prolonged dialogue In the Executive scenario, the fraudsters would often send a single payment request, together with a reason why they couldn&rsquo;t be contacted &ndash; such as being in an important meeting or about to board a flight. These standalone (and normally ad-hoc) requests often looked suspicious and so the fraudsters have started to refine their approach. It is now common to see numerous emails between the fraudster and victim, which are designed to build rapport, develop the cover story and even create the opportunity for a second or third attempt. In the supplier scenario, we have even seen cases where the fraudster is having simultaneous conversations with both the supplier and buyer (in both cases impersonating the other party), which allows them to gather additional information, answer any questions and improve the credibility of the request.</li>
</ol>
<blockquote>
While the attacks have continued to evolve, the most effective controls to combat BEC have remained consistent. If you want to protect your business, there are three simple steps which will help reduce your susceptibility to an attack:
</blockquote>
<ol>
<li>
Call Backs - If you ever receive an email requesting a payment to be sent to a new beneficiary, pick up the telephone and call the sender back to confirm the request. It&rsquo;s important to use a previously known telephone number, rather than using any numbers that are given in the body/signature of the email.
</li>
<li>Dual Approval - Whenever you need to add a new payee, or change existing payment details, configure your systems to require an approver/checker. An extra set of eyes significantly improves your chances of spotting anything untoward.</li>
<li>
Training - Ensure your staff is aware of risk. Most people have naturally good instincts, but need to understand what BEC is, before they are able to look out for it.
</li>
</ol>
 If you suspect you have fallen victim to BEC, contact your Citi Service Representative as quickly as possible so we can help to protect your account and attempt to recover any lost funds. Your security is our priority.
<a style="box-sizing: border-box; text-decoration-line: underline; background- font-size: 20px; text-align: left;" href="https://www.citibank.com/commercialbank/solutions/fraud-prevention/assets/pdf/bec-infographic.pdf" target="_blank" rel="noopener">Click here to see an infographic about BEC</a> 
&nbsp;

Awareness of Business Email Compromise is growing, but the scams are also evolving, leaving businesses vulnerable to attack. Learn more about some of the common misconceptions.

The Evolving Threat of Email Scams

Dual Approval is one of the most important online controls, yet the concept remains foreign to many businesses. This article helps demystify the topic and provides a short explanation of what it is and how it can help protect your company What is Dual Approval? As the name implies, Dual Approval is a control that requires two separate people to authorize a transaction. The first person is responsible for creating the request (known as the maker), while the second person checks and approves the activity (known as the checker). Why is Dual Approval important? Humans are not perfect. It does not matter how clever, trusted or trained we are, sooner or later everybody will make a mistake. A maker-checker process introduces a second pair of eyes and helps spot things that appear suspicious, strange or incorrect. Dual Approval clearly helps protect your business, but it also helps protect your employees from making unintended errors or deviating from process. How does it work? Dual Approval is quick and easy to set up, and it is offered at no additional cost on all of Citi Commercial Bank’s online platforms. The functionality is fully customizable, giving you the ability to configure the process flow, approvers and approval limits to meet the individual needs of your business. Once Dual Approval has been enabled, any eligible transactions will be transferred to a pre-selected pool of checkers for authorization. The process is fast, secure and robust and the approver simply verifies the request on an independent device (desktop, tablet or phone) and releases the transaction.

<h4>Dual Approval is one of the most important online controls, yet the concept remains foreign to many businesses. This article helps demystify the topic and provides a short explanation of what it is and how it can help protect your company</h4>
What is Dual Approval?
As the name implies, Dual Approval is a control that requires two separate people to authorize a transaction. The first person is responsible for creating the request (known as the maker), while the second person checks and approves the activity (known as the checker).
Why is Dual Approval important?
Humans are not perfect. It does not matter how clever, trusted or trained we are, sooner or later everybody will make a mistake. A maker-checker process introduces a second pair of eyes and helps spot things that appear suspicious, strange or incorrect. Dual Approval clearly helps protect your business, but it also helps protect your employees from making unintended &nbsp;errors or deviating from process.
How does it work?
Dual Approval is quick and easy to set up, and it is offered at no additional cost on all of Citi Commercial Bank&rsquo;s online platforms. The functionality is fully customizable, giving you the ability to configure the process flow, approvers and approval limits to meet the individual needs of your business. Once Dual Approval has been enabled, any eligible transactions will be transferred to a pre-selected pool of checkers for authorization. The process is fast, secure and robust and the approver simply verifies the request on an independent device (desktop, tablet or phone) and releases the transaction.
&nbsp;

Dual Approval is one of the most important online controls, yet the concept remains foreign to many businesses. Learn more about why it matters.

Why Dual Approval Matters

Watch a short and informative video about how to protect your business from Business Email Compromise. 

Business Email Compromise Video

Lookalike and hacked emails are helping fraudsters steal billions. Here’s how to fight them. Law enforcement agencies around the world have been investigating a scheme known as a Business Email Compromise (BEC). BEC is a scam that cyber criminals use to steal money from businesses or wealthy individuals using wire-transfer payments. Since 2013, more than $3 billion in fraud losses have been attributed to this type of fraud globally, making it the most lucrative form of cybercrime to date.[i] So how does a BEC work? In BEC scams, cybercriminals generally use social media sites — and particularly professional networking sites — as a tool to identify employees who have access to banking, financial or sensitive employee data. They then trick the employees into performing wire-transfers by sending them an email request that appears to come from an executive, such as a Chief Executive Officer or Chief Financial Officer. They try to make these emails appear legitimate so the employees perform the fund transfers to criminal accounts before they are identified as fraudulent. In some cases, cybercriminals have even hacked into the real email accounts of executives or other high-ranking businesspersons to send these illegitimate transfer requests. Despite recent media coverage on this fraud scheme, and a sobering alert from the U.S. Federal Bureau of Investigation (FBI), cyber criminals launching these attacks continue to enjoy successes as many employees are typically not accustomed to saying “no” to requests from senior leaders in their firm. In 2015, cyber thieves stole over $46 million from one company alone using the BEC technique, although law enforcement officials managed to recover approximately $8 million in this case. What might we do to protect ourselves in the face of this rising tide of BEC scams? The Cyber Security Fusion Center recommends that company leaders talk to their employees about BEC preventative and defensive measures. They advise them to be wary of emails requesting wire-transfer payments and closely scrutinize any orders deemed urgent by the sender. Whenever validity seems questionable, employees should pick up the phone to verify the transfer request. Likewise, they need to look closely for mimicked email addresses and closely review domain names (e.g. john.smith@gmail.com compared to john.smith@gmai.com). In the case of “urgent” transfer requests, companies are encouraged to consider imposing additional authentication protocols. A further precaution is reducing the number of individuals that have the authority to approve or conduct wire transfers. To restrict the number of “leads” available to BEC scammers, caution should be exercised when posting financial and personnel information to social media and company websites. If you suspect you have been targeted by a BEC, report the incident immediately to your Citi Client Relationship Manager and local law enforcement to aid in the recovery of funds. [i] https://www.fbi.gov/phoenix/press-releases/2016/fbi-warns-of-dramatic-increase-in-business-e-mail-scams?utm_source=hs_email&utm_medium=email&utm_content=28140297&_hsenc=p2ANqtz--f0buz9nDeHu9YAI5KYbMmCHIthkKaP7LIvZg0vaXQ0uUOCJWXPSxi1TSlz5gdZ_ZF9OVTPnVsL2mGryCnumjJvUj

<h4>Lookalike and hacked emails are helping fraudsters steal billions.</h4>
<h4>&nbsp;</h4>
<h4>Here&rsquo;s how to fight them.</h4>
Law enforcement agencies around the world have been investigating a scheme known as a Business Email Compromise (BEC). BEC is a scam that cyber criminals use to steal money from businesses or wealthy individuals using wire-transfer payments. Since 2013, more than $3 billion in fraud losses have been attributed to this type of fraud globally, making it the most lucrative form of cybercrime to date.[i] So how does a BEC work? In BEC scams, cybercriminals generally use social media sites &mdash; and particularly professional networking sites &mdash; as a tool to identify employees who have access to banking, financial or sensitive employee data. They then trick the employees into performing wire-transfers by sending them an email request that appears to come from an executive, such as a Chief Executive Officer or Chief Financial Officer. They try to make these emails appear legitimate so the employees perform the fund transfers to criminal accounts before they are identified as fraudulent. In some cases, cybercriminals have even hacked into the real email accounts of executives or other high-ranking businesspersons to send these illegitimate transfer requests.
Despite recent media coverage on this fraud scheme, and a sobering alert from the U.S. Federal Bureau of Investigation (FBI), cyber criminals launching these attacks continue to enjoy successes as many employees are typically not accustomed to saying &ldquo;no&rdquo; to requests from senior leaders in their firm. In 2015, cyber thieves stole over $46 million from one company alone using the BEC technique, although law enforcement officials managed to recover approximately $8 million in this case.
What might we do to protect ourselves in the face of this rising tide of BEC scams? The Cyber Security Fusion Center recommends that company leaders talk to their employees about BEC preventative and defensive measures. They advise them to be wary of emails requesting wire-transfer payments and closely scrutinize any orders deemed urgent by the sender. Whenever validity seems questionable, employees should pick up the phone to verify the transfer request. Likewise, they need to look closely for mimicked email addresses and closely review domain names (e.g. john.smith@gmail.com compared to john.smith@gmai.com).
In the case of &ldquo;urgent&rdquo; transfer requests, companies are encouraged to consider imposing additional authentication protocols. A further precaution is reducing the number of individuals that have the authority to approve or conduct wire transfers. To restrict the number of &ldquo;leads&rdquo; available to BEC scammers, caution should be exercised when posting financial and personnel information to social media and company websites.
If you suspect you have been targeted by a BEC, report the incident immediately to your Citi Client Relationship Manager and local law enforcement to aid in the recovery of funds.
&nbsp;
[i] <a href="https://www.fbi.gov/phoenix/press-releases/2016/fbi-warns-of-dramatic-increase-in-business-e-mail-scams?utm_source=hs_email&amp;utm_">https://www.fbi.gov/phoenix/press-releases/2016/fbi-warns-of-dramatic-increase-in-business-e-mail-scams?utm_source=hs_email&amp;utm_medium=email&amp;utm_content=28140297&amp;_hsenc=p2ANqtz--f0buz9nDeHu9YAI5KYbMmCHIthkKaP7LIvZg0vaXQ0uUOCJWXPSxi1TSlz5g</a><a href="https://www.fbi.gov/phoenix/press-releases/2016/fbi-warns-of-dramatic-increase-in-business-e-mail-scams?utm_source=hs_email&amp;utm_" target="_blank" rel="noopener">dZ_ZF9OVTPnVsL2mGryCnumjJvUj</a>

Lookalike and hacked emails are helping fraudsters steal billions. Here’s how to fight them.

Stay Ahead of the Email Scammers

Passwords have become an integral part of our lives, whether logging into work stations, online banking, personal email, oreven our phones. Password strength is an important component in protecting against fraud, but a frightening number of online users are still using predictable passwords. Common Passwords Data breaches are now a regular news story, which prompted SplashData to analyze over 5 million passwords that were leaked online during 2018. Their research showed that the following 25 passwords were the most commonly used; each of which could be cracked by a fraudster in a matter of seconds:

<h4>Passwords have become an integral part of our lives, whether logging into work stations, online banking, personal email, oreven our phones. Password strength is an important component in protecting against fraud, but a frightening number of online users are still using predictable passwords.</h4>
 Common Passwords
Data breaches are now a regular news story, which prompted SplashData to analyze over 5 million passwords that were leaked online during 2018. Their research showed that the following 25 passwords were the most commonly used; each of which could be cracked by a fraudster in a matter of seconds:

Password strength is an important component in protecting against fraud, but a frightening number of online users are still using predictable passwords.

Creating Strong Passwords

As digital technology continues to transform the world around us, fraudsters are becoming braver, more creative and increasingly sophisticated. At Citi, we understand the challenges you face and passionate about helping protect your business. Citi Commercial Bank has created procedures to help prevent, detect, respond to, and recover from all types of fraud attacks. Through a culture of collaboration, we fuse intelligence from a variety of sources to deter attacks, reduce risk, and foster effective decision-making.

As digital technology continues to transform the world around us, fraudsters are becoming braver, more creative and increasingly sophisticated. At Citi, we understand the challenges you face and passionate about helping protect your business. Citi Commercial Bank has created procedures to help prevent, detect, respond to, and recover from all types of fraud attacks. Through a culture of collaboration, we fuse intelligence from a variety of sources to deter attacks, reduce risk, and foster effective decision-making.

prevent, detect, respond to, and recover from all types of fraud attacks