Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need...
Transcript of Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need...
![Page 1: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/1.jpg)
Financial Management Office
Wednesday, January 15, 2020
Fiscal Administrator's Meeting
![Page 2: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/2.jpg)
Business Email Compromise Scams
Presented for the University of Hawaii Fiscal Team By Brian Ishikawa, SVP & Dir. of Corporate Security
![Page 3: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/3.jpg)
Business Email Compromise Scam Email
From: CEO
Subject: Need your help – pls keep it quiet
Date:
Message:
Dave, Can you please wire $56,000 to this company that we are investing in. I’m in a meeting right now, but you don’t need any further approvals. Your prompt attention to this is critical. Thanks, CEO
Authorized Wire
Request
Controller
![Page 4: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/4.jpg)
FBI Statistics for 2015 to 2018:
• Over 78,761 U.S. businesses victimized
• $12.5 billion fraud losses
![Page 5: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/5.jpg)
Three Examples of BEC Attacks Simple wire request from compromised email account
Faked Vendor Invoice
Elaborate story designed to make it believable
![Page 6: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/6.jpg)
Who to target And impersonate Best message
Research Target Business and Person(s) General information Personal information Customers/partners
Company news Funding
Products/patents Travel plans
OOO Compromised Email
Look-a-like Domain
![Page 7: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/7.jpg)
Fraudster
Fraudster sends email
posing as CEO Controller
Subm
its w
ire
requ
est
Conf
irmat
ion
Appr
oval
Create look-a-like domain e.g. …@payrne.com vs.
…@payme.com
(can you see the difference?)
![Page 8: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/8.jpg)
Finance Dept.
Wire
requ
est
Conf
irmat
ion
Appr
oval
“Please wire funds into an alternate account.”
Search compromised email for vendor invoices
Fraudster
Vendor
![Page 9: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/9.jpg)
From: CEO
Subject: Need your help – pls keep it quiet
To: Dave, Controller
Message: Dave, Can you please wire $56,000 to this company. I’m in a meeting right now, but you don’t need any further approvals. If you have questions, please reply to this email. Your prompt attention to this is critical. Thanks, CEO
From: Vendor
Subject: Invoice – New Process
To: Finance, Accounts Payable
Message:
Please find attached our latest invoice for the past billing period. Also note that we are implementing a new payment process. Instead of how you have previously made payments, please wire the funds directly to our account. Here are the wire instructions: Routing number: xxxxxxxxxx Account number: xxxxxxxxxx
From: CEO
Subject: Confidential – Attorney will call
To: Dave, Controller
Message:
Dear Dave, I would like to bring you in on something very important, but highly confidential. I would appreciate your timely support as well as your discretion, as we are not ready to tell the whole company about this – we are in the process of acquiring a company overseas. This is very strategic to our business. I’ll be connecting you with a lawyer in London who is brokering this transaction for us. He will provide payment instructions for you. I’m handing this project to you because I know I can trust you. I’ll check in with you periodically. Thanks, CEO
![Page 10: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/10.jpg)
CASE FILE #1 MANUFACTURER’S DILEMMA
10
![Page 11: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/11.jpg)
• A large manufacturing company’s CFO received an email from the CEO
• The email instructed an urgent $7,500 wire transfer to a new vendor to clinch a great opportunity
• The CFO quickly completed transaction • Discovery of spoofed email • Funds lost in China
Manufacturer’s Dilemma Case Summary
11
![Page 12: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/12.jpg)
Manufacturer’s Dilemma
• Carefully examine email addresses • Consider additional validation of email requests
Lessons Learned
12
• Cyber security models and strict control governance is crucial
![Page 13: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/13.jpg)
Manufacturer’s Dilemma
• Wire transfers are the payment method most impacted by business email compromise (BEC)
• Wires have been increasingly subject to fraudulent activity
Lessons Learned
13
![Page 14: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/14.jpg)
CASE FILE #2 INSURANCE NIGHTMARE
14
![Page 15: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/15.jpg)
• An insurance company authorized a $475,000 wire transfer to San Diego, CA
• Approx. 17 days later, the company notified BOH of incorrect beneficiary account used on wire
• The beneficiary refused to return the funds • Discovery of Malware infected system &
compromise of company’s email
Insurance Nightmare Case Summary
15
![Page 16: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/16.jpg)
Insurance Nightmare
• Adopt strong IT security policies & procedures • Run up-to-date, real-time antivirus software
Lessons Learned
16
• Keep systems up-to-date with patches & current operating systems
• Know social engineering techniques a fraudster may use
![Page 17: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/17.jpg)
CASE FILE #3 WASHINGTON RESIDENCE
17
![Page 18: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/18.jpg)
• A consumer client authorized a $232,950.65 wire transfer to Bellevue, WA
• Approx. 6 days later, the realtor discovered that his email to the purchaser had been tampered with
• The beneficiary bank returned $207,000 • Discovery of Malware infected system &
compromise of company’s email
Washington Residence Case Summary
18
![Page 19: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/19.jpg)
Best Practices for Detecting BEC Fraud
CHECK
CONFIRM
COACH
![Page 20: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/20.jpg)
Check for correct email addresses – …@.co vs. …@.com – …@greatsuccesss.com vs.
…@greatsuccess.com – …@abc-company vs. …@abc_company.com
CHECK
![Page 21: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/21.jpg)
Check for requests for secrecy or urgency – Be suspicious of “only use Reply” or “only call
me at this number”
Check for consistency with earlier wire payments – Does the CEO typically request wire payments
via email? – Check prior vendor invoices for domain, timing,
frequency, beneficiary, …
CHECK
![Page 22: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/22.jpg)
Use an alternate communications channel to confirm the request
Ask the CEO. Which would be worse: reconfirming the request or having money stolen?
Implement dual controls
CONFIRM
![Page 23: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/23.jpg)
Coach your employees
Coach your executives to encourage and support employees double checking wire requests
Be conscious of how information on website and social media can be used
Trust your financial institution
COACH
![Page 24: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/24.jpg)
CHECK
CONFIRM
COACH
![Page 25: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/25.jpg)
![Page 26: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/26.jpg)
Financial Management Office
Clearing Accounts
Presented by Karen Morimoto, Director of General Accounting and Capital Asset Accounting
![Page 27: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/27.jpg)
University of Hawaii Financial Management Office
Presentation Instructions
• Questions can be submitted to: ▫ [email protected] for non extramural accounts ▫ [email protected] for extramural accounts and
cost share pseudo source accounts • Presentation will be posted to UH FMO website: ▫ http://www.fmo.hawaii.edu
27
![Page 28: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/28.jpg)
University of Hawaii Financial Management Office
• Overview of clearing accounts • Monitoring of clearing accounts
Agenda
28
![Page 29: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/29.jpg)
University of Hawaii Financial Management Office
Accounting general ledger accounts that are used to temporarily hold financial transactions while the permanent accounting treatment is being determined. Balances may need to be allocated or transferred as a result of an automated or manual process.
Purpose of a Clearing Accounts
![Page 30: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/30.jpg)
University of Hawaii Financial Management Office
• Continuation Clearing Accounts – Used to receive transactions initially coded to an expired account. Frequently needed for extramural project accounts because the accounts are period specific and have expiration dates. AP 8.650 Continuation Accounts provides guidance for continuation accounts.
• General Clearing Accounts – Accounts established to accept posting from automated or manual processes when the target account or object code is invalid, not yet determined or not yet ready for posting. (Examples include: Banner Clearing, D-71 Clearing, A/R Clearing, C/S Source “Clearing” accounts, P/R Overpayment, Tax Set Off Holding) Pending new AP
Two Main Types of Clearing Accounts in KFS
![Page 31: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/31.jpg)
University of Hawaii Financial Management Office
Identification of Clearing Accounts
• “CLEARING” in account name • Account purpose text should adequately describe
reason for account ▫ CLEARING ACCOUNT FEDERAL FUNDS ▫ DESTINY NON-CR TEMP CLEARING ACCT
• Account Type Code – CL • Additional requirements for continuation clearing
accounts see AP 8.650
31
![Page 32: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/32.jpg)
University of Hawaii Financial Management Office
Clearing Account Examples
32
Account Description
Transaction Description
Reconciliation/Clearing
Continuation Clearing Account
Transactions initially coded to an expired account
Clear transactions to appropriate account within 30 days or as otherwise specified by AP 8.650
Banner Clearing Transactions are posted in KFS via Banner daily feeds
FA to work with Banner team to correct outstanding balances
![Page 33: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/33.jpg)
University of Hawaii Financial Management Office
Clearing Account Examples
33
Account Description
Transaction Description
Reconciliation/Clearing
D-71 Clearing Transaction posted via ST eDoc
Balances reclassified monthly by GAO via generated report
A/R Clearing Transactions posted via KFS-AR payment processing
Process corrections for un-cleared balances. June 30 balance should be $0
![Page 34: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/34.jpg)
University of Hawaii Financial Management Office
Clearing Account Examples
34
Account Description Transaction Description Reconciliation/Clearing
Cost Share Source “Clearing” Account
From FA DIs for cost share to CS001 subaccount
Correction needed for un-cleared transactions
P/R Overpayment Amounts due from employees due to overpayment situation
Detail of outstanding balance items need to agree to account balance
Tax Set Off Amounts intercepted from individual tax refunds to settle debt owed to UH
Detail of unapplied balance by individual needs to agree to account balance
![Page 35: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/35.jpg)
University of Hawaii Financial Management Office 35
• Automated process • Manual eDocs shall include documentation to
support the clearing transaction in the notes and attachments section of the eDoc
Documentation for Clearing Account Transactions
![Page 36: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/36.jpg)
University of Hawaii Financial Management Office 36
• Clearing accounts should be monitored on a monthly basis by the assigned FA
• Transactions should be cleared to the appropriate operating account or reconciled if pending additional information on a timely basis – generally within 30 days of posting ▫ Prior to award close out ▫ Prior to fiscal year end
• FA shall monitor clearing accounts and update responsible individuals in the event of staffing changes
Monitoring of Clearing Accounts – FA Responsibilities
![Page 37: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/37.jpg)
University of Hawaii Financial Management Office 37
• Chart managers shall monitor new clearing account creation and account modifications to ensure that appropriate attributes are assigned to the accounts
• Campus level chart managers shall monitor respective continuation and clearing accounts to ensure that respective FA are in compliance with clearing account policy
Monitoring of Clearing Accounts – Campus Responsibilities
![Page 38: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/38.jpg)
University of Hawaii Financial Management Office 38
• Periodic reviews shall be performed by central offices ▫ ORS is responsible for extramural accounts and
cost share pseudo source accounts ▫ GAO is responsible for non-extramural accounts
• Periodic reminders and communication of
clearing account requirements
Monitoring of Clearing Accounts – System Level Responsibilities
![Page 39: Financial Management Office€¦ · Business Email Compromise Scam Email From: CEO . Subject: Need your help – pls keep it quiet . Date: Message: Dave, Can you please wire $56,000](https://reader033.fdocuments.net/reader033/viewer/2022051606/60278b2142dd7963e430b326/html5/thumbnails/39.jpg)
Financial Management Office
Thank you for viewing this presentation