Many risk managers and corporate counsel are in a quandary over the latest crime wave to strike businesses—a flood of incidents involving what is known as whale-phishing. This occurs when criminals use a combination of emails and phone calls to perpetrate a fraud and scam companies out of large sums of money through fraudulent wire transfers.
Here is how a typical whale-phishing episode unfolds. A perpetrator sends a “spoofed” email (indicating it came from an email address other than the one that was actually used) to a company employee. The spoofed email address is usually that of a senior company official, which is why the term “whale” is attached to these phishing emails.
The email message is usually sent to a mid- or lower-level manager in the finance department or person with access to banking funds.
The email is typically worded as “highly confidential.” The perpetrator often selects an employee who has had minimal contact with the senior executive whose email address is spoofed. Thus, the employee will not be familiar with the executive or his or her mode of interacting with employees on fund transfer matters.
The spoofed email message typically refers to a “project” for which significant funds are required immediately, but emphasizes that the funds need to be transferred discretely. The message also informs the individual handling the transaction to expect a phone call from a trusted official outside the company, typically an attorney or accountant, who will provide instructions for transferring the funds.
The employee gets the follow-up call and usually transfers the money. Once funds are transferred, if the scam goes undetected, a second email is sent from the same executive thanking the employee for helping with the transaction and providing instructions for the next transaction.
Another call is placed to the employee, who then unwittingly arranges the second, often significantly larger, transfer of funds. This process continues until the fraud is detected.
At that point, however, the transferred funds and the perpetrators usually are long gone. These criminals are difficult to apprehend, and their accounts are almost impossible to trace.
The challenge for the risk manager then becomes trying to collect on a crime insurance policy. Unfortunately, however, insurers have been denying coverage.
With respect to crime/fidelity insurance, there often is some policy language pertaining to losses due to computer fraud. Since a portion of the scheme is carried out via a telephone call or fax, insurers contend that the fraud was not perpetrated by a computer.
Insurers also have issued denials based on their contention that the email is not a financial instrument and/or the email does not constitute a forgery of a financial instrument. Furthermore, they point out that in these situations a company employee, not an outside perpetrator, was directly responsible for the loss.
As the number of whale-phishing incidents continues to increase, risk managers and their brokers need to confirm with their insurers that they expect these types of losses to be covered under their crime insurance policies. Indeed, policy language should be reviewed carefully in this context.
To help prevent such frauds, senior leadership and all individuals with access to company bank accounts need to be made aware of the potential for such scams. Procedures should be in place to validate any and all requests for money transfers and there should be adequate redundancy in the approval process that takes place outside of email.
Be forewarned and prepared; phishing scams are out there and they can lead to large losses.