phishing

Article Dean Dorton

What controls does your business have in place to manage electronic fund transfers? How easy would it be for your Accounting Department to unknowingly participate in a fraudulent request to complete a wire transfer? Without adequate controls in place, your company could easily become the next victim of a common email phishing scheme. It is easy to think that your employees wouldn’t fall for something like this, but it happens more often than you think.

A local company recently lost over $85,000 because an employee in the Accounting Department received an email that appeared to come from one of the executives. Proper controls were not in place and funds were transferred. By the time anyone realized what had happened and the FBI could be contacted, the funds were gone and could not be recovered.

These types of scams have been around for a long time. However, the thieves are getting more sophisticated and actually put a great deal of effort into the process. It only takes a few vulnerable victims to make their effort pay off. There has been a large upswing in the number of attempts to defraud businesses – yes, even here in Kentucky!

Some attacks use a method called spoofing. Spoofing allows a sender to disguise their address and make it appear as though it came from someone else. For example, I could send an email and make it look like it came from your CEO. With the proper email security and SPAM filtering in place, most of these attempts do not make it through the filters. Properly managed email systems can recognize the spoof and block the message. More recent attempts involve the thieves actually registering a new domain name that is very similar to yours and setting up an email address that comes very close to that of your CEO or management. So close, it is very easy for your employees to not recognize the difference. Generally the email address is only one character off (e.g., jmiller@deanndorton.com instead of jmiller@deandorton.com.

The best defense against these attacks is to ensure there are strong controls around your electronic fund transfer processes that require more than an email request to process the transaction. For example, it is a good idea to require written sign-off. Note that an email does not equal written sign-off. If situations arise where you do need to use email, the recipient should always start a new email message to the requester (never reply to the request email). A text message to the requester would also add an additional layer of confirmation. However, completion of a company request form would be best. A strong control would require dual sign-off for transfers, especially those over a certain dollar amount and for new vendors (or new transfers). The key point here is having a two-step process to help minimize any opportunity for fraud.

Don’t put your business at risk by not having internal controls. For help evaluating and improving your information security and internal controls, please contact your Dean Dorton advisor or Jason Miller, Director of Business Consulting Services, at 859-425-7626 or jmiller@deandorton.com.


View Jason Miller’s Bio

Article Dean Dorton

Are you in tune with the fraud risks of your business? On October 23, Dean Dorton’s Nick Lynch and Simon Keemer, along with Timothy Beam, Supervisory Special Agent with the Federal Bureau of Investigations (FBI), shared recent examples and insights with construction professionals at the 2015 Ohio Valley Construction Conference. The panelists provided a variety of “best-practices” related to the deterrence of fraud within an organization.

According to Beam, the FBI continues to investigate cases of email phishing scams, more commonly known as the “Nigerian Email Scam.” In this scheme, scammers target victims by email, letter, text message or through social media outlets soliciting assistance to transfer money from one bank account to another bank account. In a new twist to these email scams, the email accounts of C-Suite employees or owners of the business are spoofed to create the impression that it is the organization’s executives or owners that are requesting lower level employees to make the bank transfers. If you or your organization receives such an unsolicited request, it is best to ignore the request and delete the communication immediately. In our world, where cyber security threats are continually evolving, it is important to remember to remain vigilant.

Other threats common in the construction industry include the misappropriation of assets through activities such as theft of tools and materials from job sites, bid rigging, kick-back schemes and inappropriate use of company credit cards. Financial fraud is also a risk through the manipulation of estimated costs to complete, misallocation of job costs between jobs, and general manipulation of job performance and profitability.

A common tool to assist in the detection and deterrence of fraud is the use of an ethics hotline. Hotlines are affordable to implement and provide an outlet for employees, vendors and customers to report suspected unethical behavior anonymously, either by phone or online. Certified Fraud Examiner (CFE) Nick Lynch advised that frauds are most often detected through tips – the Association of Certified Fraud Examiners (ACFE) Report to the Nations on Occupational Fraud for 2014 shows that 42% of frauds are initially detected through tips. Other common fraud detection methods include management review (16%) and internal audit (14%).

According to Lynch, “The perception of detection is one of the most effective means to prevent or deter fraud. In the construction industry, you can create the perception of detection by publicizing an ethics hotline within the organization and at construction sites.” It is also important to ensure that management fully supports the use of an ethics hotline within the organization and takes the appropriate steps to maintain confidentiality and independence while verifying the accuracy of information received from tips.

Internal audit is also an effective fraud detection and prevention activity. The panel discussed alternative ways in which internal audit procedures can be implemented within an organization in a low cost high impact manner. The discussion included how to use existing accounting personnel to perform internal audit procedures, or even outsourcing or co-sourcing internal audit with an accounting firm.

Regardless of your industry, no organization is immune to the risk of fraud. However, recognizing and understanding the risks specific to your organization is a necessary first step.

If you would like to speak with someone at Dean Dorton regarding fraud prevention, or suspected fraud, please contact Simon Keemer, Payton Miller, or Hunter Stout.