A new lawsuit brings to light the all-too common occurrence of an attack, with this occurring during a business acquisition and costing the buyer more than they bargained for.
During any M&A activity, there is lots of communication around diligence, post-transactions operations changes, contracts, and the financial transaction itself. If there was ever a time when a BEC scam shouldn’t occur, it’s during an acquisition. Such is the case of Tassel Parent, Inc., who was purchasing Graduation Alliance, Inc.
According to a brief on the lawsuit, scammers were able to pose as the shareholders of Graduation Alliance, performing the same action taken with most every computer fraud case – they asked the paying agent to change banking details from Zions Bank in Utah to – get this – a Hong Kong bank with the payment made in the name of HongKong Wemakos Furniture Trading Co.
Um, hello??? Can you say major red flag??
At the time of writing, the scammers were never identified or apprehended.
This is a striking example of how believing that the sender of an email is actually the owner of the email address is simply not enough – particularly anytime there’s money of any kind involved. Whether we’re talking about $130 Million or just $130, scammers of all types rely on people’s established sense of credibility based on an email address, display name, etc.
Anyone in your organization that handles money and communicates via email with others about said money needs to be continually made to take Security Awareness Training to ensure they understand how prolific these kinds of attacks are and how critical it is for them to verify out of band.
Here's how it works:
