Phishing

Business email compromise schemes and payroll diversion tactics led to total monetary losses of $1.3 billion in 2018, according to the FBI's Internet Crime Complaint Center 2018 Internet Crime Report published earlier this week.

The center received 20,373 business email compromises and email account compromise complaints in 2018, which led to a loss of over $1.2 billion. The center also received approximately 100 complaints of payroll diversion with a combined loss of $100 million.

Peter Baldwin, a partner at Drinker Biddle & Reath in New York, said he believes when this report comes out again next year, the numbers for both scams will have gone up. The crimes do not cost a lot of money to perpetrate, and the payoff can be in the millions of dollars.

“As long as [cyber criminals] are successful, I don't think these attacks are going to abate,” Baldwin said.

Edward McAndrew, a partner at DLA Piper in Washington, D.C., said this report shows companies have more to worry about than data breaches.

“We're not just talking about the exfiltration of personal information to be sold on the dark web,” McAndrew said. “What we're talking about now is financial fraud that is technologically facilitated.”

The email schemes and payroll diversion attacks involve cyber criminals spoofing emails of senior executives and directing employees to make payments to accounts controlled by the attacker. The report noted email spoofing has advanced over the last five years. In 2013, the FBI was seeing cybercriminals spoofing only the emails of the C-suite. Now criminals are spoofing the emails of vendors and lawyers.

The scams should be on corporate counsel's radar because they are relatively unsophisticated, Baldwin said. He explained the payroll diversion attacks are not as well-known because they appear to be a newer type of scam.

McAndrew said this is a problem beyond the information technology department's control and that IT needs to be involved with the legal department to help prevent and mitigate these kinds of attacks.

He said the general counsel and the legal department should work with the IT department to help train employees to recognize the signs of these kinds of attacks.

The key to preventing these kinds of attacks is largely employee training. Baldwin said there may be a way to block certain emails from high-risk internet protocol addresses though many cybercriminals are sophisticated enough to work get through those safeguards.

“At the end of the day it comes down to better and more comprehensive training,” Baldwin said.

When these kinds of attacks do occur, the general counsel is best situated to quarterback the company's response. McAndrew said there are legal implications the general counsel will need to navigate through and will likely face questions from regulators.