Top 5 types of fraud your business should watch out for

When it comes to fraud, size doesn’t matter: any business, big or small, can be a target. Learn about the five most common fraud strategies and find out how to spot the signs and protect your business.

Most cyberattacks start with a phishing email. This type of fraud can target anyone in your organization, from employees to C-suite executives. In these emails, scammers pose as legitimate people or organizations so they can trick businesses into giving them confidential information or money. They might also communicate on social media or via text message and phone. Their goal is to get potential victims to act impulsively and click a link, open a file or download a document. Then they’re able to install malware on the victim’s device and ultimately obtain their personal or financial information.

Ransomware is a type of malware that scammers install during phishing attacks. They use it to hijack a business’s data and hold it hostage. Then the cybercriminal asks for a ransom payment to restore the data. Ransomware attacks can have serious consequences for businesses, like forcing them to pause their operations for extended periods of time. And that can be especially damaging for SMEs. These attacks can also have reputational and strategic impacts, including permanent data loss, intellectual property theft, damage to brand image, erosion of brand trust and loss of clients and business partners.

In an imposter scam, the scammer manipulates an employee by impersonating someone they trust, like a colleague or a supplier. The scammer attempts to convince the employee to disclose confidential information or transfer funds to an unusual account. They often attempt this scam when the individual they’re impersonating is out of the office or on vacation.

Scammers often use AI to research the businesses they’re targeting and the people they’re impersonating. They refine their attacks by using automated tools to scrape social media accounts for strategic information and find out when people at the company will be away from work.

They also use generative AI to produce highly convincing fraudulent materials, like emails, documents and websites that closely mirror the visual identity of businesses and financial institutions.

One of the best ways to protect your business is to be careful about the information you share publicly on social media and other online platforms.

This is a type of business email compromise scam that’s also known as the “fake CEO scam.” Scammers usually start by hacking the email account of the person at the head of the business. Using that email address as a cover, the scammer contacts an employee who’s authorized to carry out transactions, like an administrative assistant, procurement officer or accounts payable clerk. The scammer claims that there’s some kind of emergency or major acquisition that requires money to be sent to another account, often in a foreign country.

They might use AI to:

- Imitate a business leader’s voice to order an urgent transfer over the phone.

- Make deepfake videos in which the leader announces changes to certain guidelines.

In this type of fraud, a scammer hacks the email account of a business’s supplier. They email the business from the supplier’s usual email account to announce a change in their banking information and ask that future payments be made to a new account. But the new banking information is phony, and the business’s future payments don’t actually go to the supplier.

Here, scammers impersonate representatives from a financial institution and call business owners or employees. They usually claim there’s an urgent issue or suspected fraud in the business’s bank account.

During the call, the scammer may:

• Send an email with a fake login link asking the owner or employee to enter the company’s banking credentials.
• Ask them to install remote access software.
• Ask them to dial a combination of digits on the phone, preceded by a code like *21 or *71, in order to redirect the phone line to the scammer.

A scammer impersonating an IT technician calls a business owner or one of their employees. They claim they need to perform an urgent update, fix or maintenance to address a critical issue that could threaten the computer or network. They might also claim that the computer has been infected with a virus or malware. Then they ask to install remote access software so they can connect to the computer and secure it. They’re actually trying to access the device to steal usernames, passwords and the business’s banking information. They can then use that information to transfer funds or steal confidential data.

One of a business’s “customers” sends a cheque to pay for goods or services they have received. But the cheque is for more than they owe. Instead of writing a new cheque for the correct amount, the “customer” suggests that the business go ahead and deposit their original cheque and transfer them the amount they overpaid. The cheque often turns out to be fraudulent. And the business ends up losing the money for the goods and services and the amount they reimbursed for the “overpayment.”

Scammers are using new technologies and schemes, but they still rely on the same old manipulation tactics:

• Claiming something is urgent
• Emotional manipulation (stress, fear, curiosity)
• Appeals for discretion
• Unusual payment methods
• Emotional triggers

Being aware of these tactics can help you and your employees spot scams before it’s too late.

Educate your employees about fraud risks, warning signs and the procedures they need to follow. You can roll out hands-on initiatives like training sessions, email phishing simulations, reminders about best practices, mandatory training and talks by experts.

Organizations like Cybereco have documentation on best practices and tools to help raise awareness. By frequently offering advice and awareness activities, you can help your staff become more vigilant and develop good habits. As technology continues to evolve, fraud strategies are becoming more and more sophisticated, so it’s important to be consistent in your messaging.

Set up clear procedures for transferring funds, including limits on how much can be sent and who can approve requests. Make sure everyone who’s authorised to make transactions on behalf of the organization is aware of the risks involved and the procedures in place.

To take things a step further, you could ask employees to verbally confirm every transaction request they receive from an executive, for example by having the employee call the executive. It’s important for employees to use official phone numbers, not ones contained in emails. And even if they seem legitimate, conflicting instructions must be ignored.

Speak directly with your suppliers to double check before updating their banking information. Always call them at the number you have on file, not ones contained in their emails.

When you receive an email, pay attention to the information after the at sign (@) in the sender’s email address. If it looks suspicious or you don’t recognize the sender, the email is probably fraudulent. Scammers often change just one letter in hopes of slipping under your radar. For example, they often replace the letter “m” with “r” and “n” (rn). When they’re next to each other, they look very much like the letter “m”. That’s why vigilance is key!

And never click on any link or attachment from an unknown sender. To check whether a hyperlink is legitimate, you can hover your mouse over the link WITHOUT clicking on it. The actual URL behind the link will appear. If it seems suspicious in any way, DO NOT click the link.

Spoofing techniques make it possible for fraudsters to display names and phone numbers that look legitimate. On the phone, never trust caller ID.

Ask your employees to use strong passwords containing at least 12 characters, like passphrases.

It’s also better to use a password manager instead of writing down login information in an Excel sheet, for example. It’s both easier and more secure.

Help limit fraudulent transactions in your accounts and support the investigation process by quickly contacting:

• Your financial institution
• The Canadian Anti-Fraud Centre
• Your local police

Want to read more?