On April 6, 2020, the Federal Bureau of Investigation (FBI) issued a warning to companies to be aware of an increase in business email compromises (BEC) entitled “FBI Anticipates Rise in Business Email Compromise Schemes Related to the Covid-19 Pandemic.” Although BECs have been around for years, attackers are using the fact that many employees are working from home during the pandemic to their advantage. The typical BEC involves the attacker impersonating the CEO or other top executives to request an urgent transfer of money or to obtain personal information of employees.

With employees working from home, attackers are relying on the fact that assistants and others are not able to confirm these requests from the executives as they are not in the same physical proximity to the executives as they are when working in the office. Normal security measures may not be followed due to the transition from work to home.

The FBI listed one example in which $1 million was transferred to a fraudulent account when the “CEO” requested the transfer. The “CEO’s” email address had one letter that was different from the actual account, yet the transfer was approved. According to the FBI “[T]he email requested a different transfer date and a change in the account number ‘due to the coronavirus outbreak and quarantine processes and precautions.’”

According to the warning:

“To protect yourself from this fraud, the FBI advises you be on the lookout for the following red flags:

* Unexplained urgency

* Last-minute changes in wire instructions or recipient account information

* Last-minute changes in established communication platforms or email account addresses

* Communications only in email and refusal to communicate via telephone or online voice or video platforms

* Requests for advanced payment of services when not previously required

* Requests from employees to change direct deposit information

The FBI also recommends the following tips to help protect yourself and your assets:

* Be skeptical of last-minute changes in wiring instructions or recipient account information.

* Verify any changes and information via the contact on file–do not contact the vendor through the number provided in the email.

* Ensure the URL in emails is associated with the business it claims to be from.

* Be alert to hyperlinks that may contain misspellings of the actual domain name.

* Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender’s email address appears to match who it is coming from.”

Criminals are always looking to attack during particularly vulnerable times. The COVID-19 pandemic and the transition from work-at-the-office to work-at-home create a perfect scenario for criminals to take advantage of by launching BEC schemes. Sharing the FBI’s red flags with your employees is one way to minimize that risk.