Common business scams
One of the most effective ways to avoid being scammed is to be aware of the most common methods used by fraudsters to compromise the security of your business. In general, there are a few different methods used to trick you or your employees.
Educate yourself
Many of the scams targeting businesses fall under the category of “social engineering.” This is a process by which scammers rely on the act of manipulation and our desire to lend a hand or respond to urgent requests so they can commit financial fraud.
When thinking about cybersecurity, you should also consider how employees can be vulnerable to social engineering and how they might be tricked into giving information to a scammer simply while trying to do their job.
Types of business scams
-
Phishing/Vishing/Smishing
What is it?
If we think of cybersecurity attacks, we might think of hackers analyzing lines of complex code, searching for vulnerabilities in software or hardware. But that’s not always the case. Hackers are now targeting employees to exploit human emotions, social ties, and the innate desire people have to do the right thing or respond to urgent requests through emails (phishing), text message/SMS (smishing), and phone calls (vishing) based social engineering attacks.
Phishing is a form of social engineering in which hackers use fake emails to trick the recipient into providing personal or sensitive information that can be used for fraudulent purposes.
Vishing is the telephone equivalent of phishing. It’s the act of using the telephone to scam the call recipient into surrendering sensitive information that will be used for identity theft.
Smishing is another form of phishing that involves criminals using a text or SMS message to try and obtain sensitive information from the recipient.
Social engineering scams are a tried and tested method for scammers to breach your business and obtain information that could jeopardize your business’s sensitive data or revenue. Moreover, scammers are becoming increasingly sophisticated in their efforts to accomplish this.
Scam examples
Spear phishing
Spear phishing is a targeted email designed to trick individuals or small groups into sharing information or allowing malicious code to run on their device. This technique uses more sophisticated technology and personalization to evade email filters and convince victims that the email is legitimate.
Notifications
Smishing can include bank notifications, package tracking updates, or urgent warnings that act on a your desire to resolve a problem. Be aware that Scotiabank will never call you and demand that you divulge personal financial information about you or your business.
Urgency or excitement
Vishing attacks often involve a sense of urgency, like dealing with a tax or legal matter, or a sense of excitement, like winning a prize or a free trip. These attacks prompt you to divulge personal and financial information that can be used for fraud or identity theft.
How to protect yourself
These scams often contain urgent or provocative requests and are disguised to look legitimate and may even seem to come from sources that are familiar to you.
Always stop and take the time to carefully evaluate emails, phone calls, or text messages requesting sensitive information, especially when the request is urgent or the deal seems too good to be true.
-
Malware/Ransomware
What is it?
Malware, short for malicious software, refers to any software designed to steal sensitive data and damage or destroy computers and computer systems.
There are many different types of malware that exist, including viruses, worms, Trojan horses, spyware, adware, and ransomware. No matter the type of malware, they all share the same objective — to capture and steal sensitive information and disrupt computer systems.
Ransomware is an extremely popular type of malware affecting businesses today, which can attack and encrypt (lock) your system to extract a ransom.
Malware is designed to hide within the operating system and avoid security safeguards. If you have ransomware on your computer, you might not know it. It can lie dormant until activated by a scammer to encrypt (lock) your files and demand payment.
Ransomware will lock your files so that they become unusable or untouchable in the hopes that you’ll pay the ransom to retrieve them.
Removing ransomware and decrypting your files can be a significant challenge even for IT experts.
Note that even if the ransom is paid, there is no guarantee that your files will be decrypted. It’s also possible that the scammer could sell your information, leak it online, or delete it.
Scam examples
Infected downloads
Downloading an infected program from an illegitimate website is the most common way to unintentionally install malware on your systems.
Because malware is designed to look legitimate, it’s easy to mistake it for a genuine program that you might actually want on your computer.
Although many websites offer free downloads, you should only download programs and software from reputable companies.
In addition, malware can also be installed by clicking a link in an email or text message.
Surf with caution
Another way to unintentionally download malware to your device is by visiting an infected website.
These websites have been designed to look real but may contain elements that initiate a malware download. These elements include:
- Advertisements
- Fake error messages
- Pop-up windows
Learn more about how to spot a malicious website.
Suspicious Attachments
Some phishing emails contain malware that’s disguised as an attachment. These attachments are a common way to infect your computer.
By simply opening an attachment infected with malware, you may be falling into a scammer’s trap, with the malware running in the background unnoticed.
How to protect yourself
Protecting your systems from malware and ransomware is a process that involves:
- Identifying and installing malware safeguards (for example, anti-malware software and firewalls)
- Educating employees to build awareness and recognize potential risks
- A commitment to building plans, processes, and policies that diminish the likelihood of encountering the malicious software
-
Business Email Compromise
What is it?
Business Email Compromise (BEC) is a form of fraud that attacks both large and small businesses.
Technically a form of spear phishing, BEC attacks companies conducting regular payment processing activities, taking advantage of employees with access to sensitive company or customer data and those responsible for vendor management and payment processing activities.
As commonly presented, the scam plays out when a fraudulent email or message arrives from someone pretending to be the CEO, a senior manager, or a third-party vendor, requesting an immediate money transfer, a change of account number or invoice, or access to sensitive data.
Scam examples
The CEO scam
As part of this scam, fraudulent emails are sent to finance team employees from scammers claiming to be senior management — either a Chief Executive Officer (CEO), Chief Financial Officer (CFO), or anyone with the authority to sanction a money transfer. The scammer will forge (spoof) the email’s “from” address so the message appears to have been sent from a legitimate email address.
The phishing email will use social engineering tactics to trick the recipient into wiring money to an unknown party.
The email will be written with a sense of urgency and will likely insist that the transfer remain confidential.
Change payment schemes
Fraudsters sometimes send emails that look like they’re from suppliers or customers that your business has a well-established relationship with.
They will set up a fraudulent account using a fake email or phone number, pretending to be a trusted supplier or an existing customer. The fraudulent emails will request that you transfer payments from an existing account to a new account that the fraudsters control.Information theft
Scammers may also seek to manipulate employees into releasing other employees’ or customers’ personally identifiable information (PII). This information can then be used in further fraud, such as phishing attempts, CEO impersonations, or to create fake invoices and accounts.
How to protect your business
Be sure to train your employees on how to identify phishing scams, especially spear phishing and Business Email Compromise scams. Always reinforce the fact that email addresses can be spoofed (forged) and must be carefully verified.
Reiterate to your employees the need to look out for red flags, such as a sense of urgency. If there’s a sense of urgency regarding a wire transfer or payment, advise your employees to inform their manager.
Employees should always reach out to a known contact to confirm requests for transfers of funds from customers and suppliers. Use known numbers, not the details provided in the most recent email request, as they can be faked.
-
Cheque fraud
What is it?
Cheque fraud is still on the rise. From small businesses to large enterprises, companies of all sizes can become victims of cheque fraud.
If someone uses a cheque illegally to obtain funds, they’re committing cheque fraud.
Stolen cheques can be intercepted in the mail.
Learn how to recognize different types of fraud so you can protect yourself and your business from fraudsters
Scam examples
Counterfeit cheque
Counterfeit cheques generally have slight differences compared to legitimate cheques.
The colour, logo, font, and security features may vary.
Altered cheque
Materially altered cheques are valid and authorized items but contain changes to the:
- Payee’s name
- Date
- Amount (numeral/written)
- Time of payment
How to protect your business
Protect your business from card and cheque fraud by reviewing your transactions daily. Having a good understanding of your finances will always add an extra level of security.
If you suspect your card/PIN has been compromised or spot any fraudulent activity on your account, please contact us immediately at 1-866-625-0561.
-
Wire payment fraud
What is it?
Wire payments continue to be a target for fraudulent activity due to the speed and higher dollar limits of the transaction. Common methods of wire payment fraud include business email compromise (customer email hack/vendor email hack), account takeovers, malware, and phishing (including smishing and vishing).
Remember, you should never feel rushed to respond when working with a trusted organization.
Fraudsters know that money sent through a wire transfer is difficult to recover because of speedier settlement and the complexity involved in the recovery of funds sent between different jurisdictions.
Employees who are responsible for processing wire transfers are deliberately targeted.
Social engineering tactics play a major role as fraudsters rely on an employee’s sense of duty and desire to do the right thing in an urgent situation.
Employees must always take the time to decide whether or not the wire payment request is genuine before processing a transaction.
Scam examples
Change payment instructions
A common wire payment scam occurs when a fraudster sends an email pretending to be a trusted supplier requesting a change of wire payment instructions or account information. The email may request a change of account payment details so that funds are forwarded to a fraudulent account or include a malicious link that downloads malware onto your device and network.
Spoofing
Email spoofing occurs when a fraudulent email is created using a fake sender address to trick the recipient. There are 3 common methods used to spoof an email:
- Forging the contact name and email address visible to the recipient
- Setting up a valid email address with a name of someone in your organization
- Creating a new email address that looks like the real one
Urgency
While some fraudsters spend weeks grooming a business target, one of the key red flags for wire fraud remains a false sense of urgency.
Always think before making a wire transfer, and make sure all protocols are followed before a transfer is initiated.
How to protect your business
Report an incident or suspicious activity