To print this article, all you need to do is be registered or log in to Mondaq.com.
Businesses are constantly targeted by criminals trying to gain access to information that will allow them to fraudulently divert wire transfers. This fraud often occurs after the criminal has done enough reconnaissance to determine who in the company likely has a professional role in approving or initiating wire transfers. This employee – often a finance executive such as the CFO – will then be targeted and an attempt to compromise their email account will be attempted. If successful, once inside the email account, the criminal will modify the “rules” so that incoming messages containing terms such as “transfer”, “transfer”, “bank”, “account”, etc. . be immediately routed to a fraudulent email account and deleted from the legitimate email account.
The criminal will then take over communications with customers or vendors who are in the process of initiating wire transfers to the business. The impostor will impersonate the legitimate account holder and issue new wire transfer instructions – often attributing the change to previous fraud on the account. The customer or seller then follows the new wire transfer instructions and initiates a wire transfer which is forwarded to the fraudulent account.
Another version of the scam is to use unauthorized account access to redirect incoming transfers intended for the business to a fraudulent account. Businesses that owe money to the victim are notified that account details have changed and payments from accounts payable are redirected.
This exploit has become a multi-billion dollar criminal business model.
What can you do to protect yourself?
Although billions of dollars have been lost to criminals in recent years through fraudulent money transfers, this trend must not continue. If companies are able to detect a fraudulent money transfer within 72 hours of the initial transmission, the
Financial Fraud Prevention Chain (FFKC) can be launched in an attempt to stop the transfer. While funds may not always be recoverable, even if the kill chain is initiated within the 72 hour window, recovery is much more likely to occur than if attempted outside of this window.
The FFKC involves a relationship between the FBI, the Financial Crimes Enforcement Network (FinCEN) and the Egmont Group, to help stop the fraudulent international transfer of funds by criminals. The FFKC is intended to be used as a means for US financial institutions to obtain reimbursement of funds from victims. The FFKC can be used if the fraudulent bank transfer meets all of the following conditions:
- the wire transfer is $50,000 or more;
- a SWIFT recall notice has been issued; and
- the bank transfer took place within the last 72 hours.
If the bank transfer does not meet the above criteria,
it should always be reported to the FBI as soon as it is detected. The FBI may be able to aggregate case details with other investigations to recover funds and/or hold malicious actors accountable.
How does the FFKC process start?
To initiate the FFKC process, upon detection of a fraudulent money transfer, a complaint must be filed immediately with the Internet Crime Complaint Center (IC3). The IC3 report can be filed online here.
If possible, the following information should be provided in the complaint:
- Name and address of the victim company;
- Type of transaction (i.e. bank transfer), amount and date;
- Name and address of the victim’s bank (i.e. the bank of origin);
- Victim’s bank account and routing number;
- Beneficiary bank name and address (i.e. Beneficiary Bank);
- Name and address of the beneficiary bank;
- Recipient’s bank account and routing number;
- SWIFT number of the recipient’s bank; and
- Summary of the incident.
The more information provided about the incident, the more effectively the FBI can respond. As soon as the report is filed with IC3, an FBI agent in the geographic jurisdiction of the victim bank should be contacted and given the IC3 report and any other relevant details. The FBI can then interact with the victim bank to ensure that everything is done to recover the funds. You can find a map of the FBI field offices here.
The content of this article is intended to provide a general guide on the subject. Specialist advice should be sought regarding your particular situation.
POPULAR ARTICLES ON: United States Criminal Law