Cybercrime Spotlight –  Invoice Hijacking

Cybercrime Spotlight –  Invoice Hijacking

Cybercrime continues to rise, affecting businesses of all sizes.  Cybercrime and scams come in many forms, but the bottom line is that businesses lose a lot of money to them every year.

This blog focuses on Invoice Hijacking and Invoice Fraud, which is also known as a business email compromise scam.  According to this 2021 Report, invoice scams of this type cost businesses a collective $2.4 billion, with an average loss of $120,000 per incident.

Invoice Scams happen in one of two ways.  The first type of invoice scam occurs when a business pays a fake invoice, believing it is a legitimate invoice for goods or services.  The second occurs when a business pays a legitimate invoice, but the payment goes to a fake account instead of the intended recipient.

How the Scam Works

There are several ways in which invoice fraud scams are successful, from inside jobs to hijacked email accounts.

• Vendor Impersonation – These types of scams are where the vendor’s email and website remain secure, but scammers create a very similar domain or email that looks like the original but has minor differences that can easily go unnoticed. They then send fake invoices to companies from the fake email addresses and hope they go unnoticed. For example, [email protected] may be a legitimate email, so if someone receives an invoice from [email protected], they may not notice and will pay it.
• Hijacked Accounts – This is where an employee’s account gets hijacked, either through social engineering, phishing, or malware, and the scammer will send fake invoices with changed payment details to clients using a legitimate email that they currently control.  The goal is to get as many payments made to the changed bank information before getting caught.
• Fake invoices – These are the hallmark of the scam, where a very legitimate-looking invoice is sent out for payment, but the invoice is fake, with the contact information either directing to a compromised account or a fake email, and the bank information is for the scammer’s bank and not the actual vendor. These usually very closely mimic the real invoices.

Spotting the Scam

Businesses need to make their staff aware of the red flags to look for when getting and paying any invoices.  Here are some things to look out for:

• Verify the email address – Make sure that the email address is legitimate and linked to the company and is similar to the actual email address or domain name.
• Unexpected invoices – Scam invoices usually have a sense of urgency, urging immediate payment to avoid consequences. If you are not expecting an invoice from a vendor and one is received with phrases like “urgent” or “pay ASAP”, double-check that this is a real invoice.
• Spelling and Grammar – Scam emails and invoices often have awkwardly phrased wording and poor spelling. These are common in fake emails and invoices.
• Lack of Contact Information – if the only contact information is directed to the same email address that the invoice came from, with no working phone numbers or links, that is another sign of a scam.
• Different Bank information – If the bank information is different from prior payments, that is another red flag.

Businesses should put verification protocols into place to verify all vendor payments before they happen.  Employees should also be trained on how to spot phishing, social engineering, and fake invoice scams.  If you receive a fake invoice, report it to https://reportfraud.ftc.gov/, and report compromised emails to the FBI at IC3.gov.

Cyber Liability insurance helps protect your business from costly cybercrime losses, including invoice hijacking. Some carriers even provide free or discounted security services and employee training to help spot scams when received.  We would love to discuss your options with you.  Please email [email protected] or [email protected] for more information on cyber insurance options.