Whaling attempts could cost you your job and lose cash for your company

Convincing an unsuspecting treasurer or controller to wire money into the wrong hands seems like a difficult task, however, thieves are proving it’s possible. Whaling attacks, which are specifically directed at senior executives and other high profile targets within businesses are quickly becoming more convincing with well-researched spear phishing emails, ultimately allowing them to impersonate a company officer well enough to hook corporate officials into wiring funds in the wrong direction.

Here’s how a scam like this can play out:

Initially a thief will choose a company to target. Once the target company is established, they do the necessary research by sifting through records and various public company web pages and associated corporate social media outlets to identify the correct company executives to incorporate in their scam.

From there, the phisher determines the name and email address of the president or CEO of the company, and the name and email address of the treasurer or whoever has the authority to execute financial transactions for the company.

Once the correct name and emails are retained, the phisher will register a domain that upon a quick glance, will appear exactly like the company’s actual domain. This is accomplished by using simple keyboard tricks like combining two letters to look like one, or replacing the letter “l” with the number “1” – the possibilities are endless. Here’s an example:

Theoretical example: company.com

Thief’s forged domain: cornpany.com

Depending on the font, these two domains may be almost indistinguishable — even when they’re placed right next to each other. Once the factitious domain is established, the email addresses fall nicely into place. For example, “ceo@cornpany.com” sure looks a lot like “ceo@company.com” when it’s sitting in your inbox. Would you notice?

Often, the “From” header is the real CEO’s email address, and there is a “Reply-To” header with the “look-alike domain” address. We’ve seen a few cases where the domain registered for collecting replies doesn’t resemble the target domain at all.

Additionally, some cheapskate thieves don’t bother with registering a domain at all, and just use a throwaway account at a free email provider like Hotmail or Yahoo. The “From” address is often the real email address of the CEO, with a “Reply-To” header to divert replies back to the thief. This might be considered less suspicious than the “look-alike” domain. In this case there’s always a chance that the CEO really does have a personal Gmail account that he uses from home or when on the road. To complicate matters further, there are many “free email” domains that are less well known, like execs.com, which is perfect for this sort of scam.

If the target replies to the scam, responses are directed to the thief who’s impersonating the CEO. And if by chance the target questions the expenditure or shows any resistance, the fake CEO will reply, emphasizing the urgency of getting the payment sent immediately.

This isn’t the only way a scam like this can work. Another approach we’ve seen is a bit more casual, where the text of an email may be nothing more than something like this: “Bob, are you in the office? It’s urgent that we get an overdue payment sent by wire transfer today. Email me when you get this, and I’ll send the details.”

With those scam angles in mind, below are some real-world examples of similar attacks. Only the names, addresses, and account numbers have been changed.

In this first example, note the doubled “i” in the “From: Bob CEO” domain name (the fake CEO). This was a domain registered at a “free domain hosting” place for the purpose of this fraud attempt.

It was at about this point that “Ray” figured out he wasn’t talking to the real CEO, and broke off communication. This particular attack used a foreign bank, however, we’ve recently seen similar attacks like this that use a domestic bank and ask for smaller amounts of money. The large amount here seems to have been one of the things that triggered Ray to question the transfer.

In the next example, the crook tried to social engineer the information he would need to do his own wire transfers. Basically, use email communication to convince the target to break normal security procedures. In this case the thief also used an aol.com Reply-To address.

Fortunately, Mary wasn’t fooled and never responded to the thief.

Not all “free email” domains are the ones you might expect, like Gmail, Hotmail, or Yahoo.

The domain “execs.com” used here is a free mail domain at mail.com. They have hundreds of different “free email” domains that you can choose from. In this case, the spam filter was able to identify and quarantine these emails. Unfortunately, in this case, Ray got his daily “quarantined email” report, said “Oh, no, the spam filter is blocking important email from my boss!” and replied to the thief.

In most of the recent examples we’ve seen, money will typically be wired to a well-known U.S. bank where the account belongs to a real person, with a real address. However, a week ago Molly answered a spam email titled, “Make Money Working Part Time From Home,” and she now thinks she’s working for a legitimate company, processing payments transferred to her personal account, and sending them to the home office in Shanghai or wherever — minus her commission.

When the fraud is discovered, and the FBI comes looking only to find the trail ending at Molly — she could be on the hook for all the money that went through her personal account.

There’s no way to stop thieves from crafting scams like these, but you can protect yourself and your business by staying defensive with user vigilance and clear, secure company policies regarding how financial transactions can be authorized. Even when a spam filter detects and quarantines email threats, the company can still get stung if the recipient views a quarantine report and thinks, “Oh no, the spam filter blocked an email from the CEO.”

The bottom line is that money should never be transferred based on an unauthenticated email. Everyone up to the CEO should sign off on a clear policy stating that a wire transfer can never be ordered with just an email. Additionally, everyone with the ability to initiate a wire transfer, should know never to do so based on just an email, no matter who it’s from — even if it is the CEO.

• About
• Latest Posts

Mike Van Pelt

Threat Analysis Engineer at Barracuda Networks

Latest posts by Mike Van Pelt (see all)

• A World Full of Spear Phishing: What it is, and What to Look Out For - February 22, 2016
• Whaling attempts could cost you your job and lose cash for your company - July 2, 2015