5 Current Fraud Trends in Business

In today’s world where most information is stored on the cloud and employees are working more frequently from home, it should come as no surprise that the top trending business fraud schemes come from the cyber world. The Covid-19 pandemic has resulted in more people working remotely, a change that was for many companies both sudden and unexpected – but absolutely necessary. As a result of this phenomenon, cyberfraud has soared. Cyberfraud is any type of fraudulent crime that is conducted via a computer or computer data. In the early days of the pandemic in 2020, cloud-based attacks rose 630% between January and April as employees were forced to work remotely. Organizations were not ready cybersecurity-wise for this to happen. As a result, ransomware attacks rose approximately 148% in March 2020 alone. Cyber Fraudsters were able to quickly find a weakness and attack in short order!

As companies and their employees have realized that working remotely can be done with little to no effect on productivity, working outside the office is becoming the norm. By 2025, it is estimated that 36.2 million Americans will be working remotely – up 87% from pre-pandemic levels. Additionally, approximately 53% of US employees want to continue working remotely, even after Covid-19. Remote work, as many companies discovered in 2020 and 2021 poses cybersecurity risks for organizations.

Cyber Fraudsters have found a more lucrative “business environment” in which:

The global cost of cybercrime has reached approximately $6 trillion annually in 2020/2021;
If cybercrime were measured as a country, it would be the third largest economy after the US and China; and
In 2020 alone, approximately 55% of attacks were attributed to organized crime gangs.

The Top 5 Cyber Fraud trends in 2021 included ransomware, business email compromise, data breaches, phishing, and insider threats. Below I will go into more depth about each of these trending cyber fraud schemes and what measures you can take for business fraud protection.

1. Ransomware

Malware is a harmful software that seeks to invade, damage, or disable devices, often by taking partial control over the device’s operation. Ransomware is malware that compromises files and computers through:

Crypto-ransomware, which encrypts your hard drives or files & folders; or
Locker-ransomware, which only locks users out of their machines, without encryption.

Either of these situations allows the cyber fraudster to hold significant leverage over a company until the company pays significant sums of money, typically paid in cryptocurrency, to the cyber fraudster in order to get their systems back.

Malware Developers are constantly innovating ways to commit their fraudulent deeds. Reports show that approximately 41% of malware families observed were previously unknown. Companies should know that malware quite often targets end-of-life software. One example of this is the targeting of Windows 7 software which was being sunsetted by Microsoft (in favor of Windows 10). Malware targeting of Windows 7 increased by 125% between 2018 and 2019, with support for Windows 7 ending in January 2020. If you are running Windows 7 software you are 3 times more likely to get infected than if you are running Windows 10.

2. Business Email Compromise (BEC)

Business Email Compromise occurs when a compromised or spoofed email from a CEO is sent to a company employee (usually in the finance department) directing them to transfer company funds to an account controlled by the cybercriminal, whereby a significant amount of company funds are extracted by the cybercriminals. BECs currently represent approximately 50% of cybercrime losses in the United States. To commit this type of fraud, the cybercriminal doesn’t need to be tech-savvy, they only need to be able to make the targeted finance employee trust that they are indeed receiving an email from the Company’s CEO (or other company executives).

BECs are evolving to become more sophisticated and more successful – a current growing threat is Vendor Email Compromise (VEC). A VEC starts with an employee’s account being compromised by a cybercriminal. That compromised account is used to notify the company’s customers that a change has been made to where the remittance of invoices should be directed. The company’s customers, following the new remittance directive, send payment to the cybercriminal’s account, whereby the cybercriminal collects funds that the company now never receives.

3. Data Breaches

A Data Breach is an incident that exposes a company’s confidential or protected information intentionally or unintentionally. Data that is compromised will typically include company and customer information. Cybercriminals typically sell that data to other parties. Breaches can happen when a company has not protected itself from a security breach, including:
information system vulnerability;

weak passwords;
drive-by downloads; and
targeted malware attacks.

Care needs to be taken by the company to constantly be aware of the need to both updates and strengthen its security over its data.

4. Phishing

Phishing is a cybercrime in which targets are contacted by email, telephone, or text message by someone posing as a legitimate institution to lure employees to provide sensitive data, such as personally identifiable information, banking, and credit card details, and passwords. The information is then used to access important accounts and can result in identity theft and financial loss.

Common features of phishing emails to company employees include:

too good to be true;
sense of urgency;
hyperlinks;
attachments; and
unusual senders.

Other examples of trends in phishing include:

Clone phishing – a virtual replica of a legitimate email previously received by the victim but with malicious links or attachments – the cybercriminal will use an excuse for “resending” the email, such as an issue with the link or the attachment they want the target to click on.
Domain spoofing – the cybercriminal spoofs the organization or domain name to make emails look like they originate from the official domain or fake websites that adopt the design of the legitimate site using a similar URL – example: sbm@abcconnect.com vs. sbm@abcconect.com.
SMiShing – a text message that appears to originate from a legitimate source but contains malicious links or coupon codes.

5. Insider Threats

An Insider Threat is a cyber event caused by employees, either by mistake or maliciously. In 2019, approximately 30% of all breaches were caused by insiders. The damage caused by a malicious employee can be great. An employee who has been fired or laid off can often rationalize hurting the company that has hurt them. At times a disgruntled employee can offer assistance to an outside party to breach company safeguards over data and other sensitive matters. Care needs to be taken by the company to monitor employee behavior at all times, particularly when employment is terminated, so that appropriate security measures are taken so the terminated employees can no longer access any company data.

Losses to your company from these trending areas of Cyberfraud can have a significant negative impact on your business in many areas, not all of which are financial, that include:

productivity losses;
response costs;
replacement costs;
competitive advantage losses;
fines and judgments; and
company reputation damage.

5 Steps to Consider to Protect your Businesses from Fraud

Training – train, train, train! – Training employees about signs of fraudulent activity can help them recognize that an email or link may be a fraud. Teaching your employees about procedures for reporting fraudulent activity can also help a company assess and strengthen its weak spots before a major breach arises.
Risk Assessment – where is my company weak? – Understanding where your company is lacking or weak against cybercriminals can help you take precautions and protect your business before an attack happens.
Implementation of automatic security updates.
Developing an action plan to provide security over mobile devices.
Developing a business continuity plan should security fail.

It’s important to remember that “Computers don’t create crimes. It’s the people who are using the computers who commit the crimes.” So, train, train, train your people; monitor your people, use data loss prevention (DLP) software; block cloud storage; and manage and limit access to sensitive data.

Amplēo Can Help

If you or your business is the target of fraud, reach out to Amplēo. Its consultants help detect fraud, support litigation to reclaim lost assets, and implement controls to prevent future occurrences.