ACCT 660 Week 5 Discussion Board Forum 3 Thread Example

Discussion Board Forum 3 Thread: Cyber-Enabled Payment Fraud Against Businesses

ACCT 660 Information Technology and Fraud, Discussion Board Forum 3 Thread

Thread by [Student Name]

The thread answers a composite prompt on cyber-enabled fraud; the studies and government report cited are real.

Business email compromise succeeds because it attacks a business process rather than a computer. The fraudster does not need to break into the accounting system; it is enough to persuade one employee, by email, to send money to the wrong account. For that reason, the controls that matter most are not email filters but the steps a company takes before money leaves its bank account.

The scheme takes several forms. In the most familiar, a fraudster sends a message that appears to come from the chief executive, asking an accounts payable employee to wire funds urgently for a confidential deal. In another common version, the fraudster compromises or imitates a real vendor's email and sends an invoice with new bank details, so the company pays a legitimate bill into the fraudster's account. Variants target payroll changes, real estate closings and requests for employee tax forms. What they share is a believable message that asks for a routine action at an unusual moment.

The losses are large. The FBI's Internet Crime Complaint Center reported more than $2.9 billion in adjusted losses from business email compromise complaints in 2023, making it one of the costliest categories of internet crime the center tracks (Federal Bureau of Investigation [FBI], 2024). Because many victims do not report, the true figure is likely higher. For a single company, one successful message can cost more than years of ordinary employee theft.

Research explains why the scheme works on careful people. Cross and Gillett (2020) describe business email compromise as a fraud built on exploiting trust, in which offenders study an organization's relationships, adopt the identity of someone the victim already trusts and time requests to fit normal business activity. The fraud borrows its credibility from a relationship the company already has. An employee who pays a familiar vendor's invoice is doing exactly what the job requires, which is why the request does not feel suspicious.

Studies of phishing susceptibility add the behavioral side. Vishwanath et al. (2011) tested a model of why people respond to phishing emails and found that attention to cues in the message, such as urgency, and habitual patterns of email use both affected whether people complied. People who handle large volumes of email quickly and habitually were more likely to respond without scrutinizing the message. Williams et al. (2018) studied simulated phishing in a workplace and found that messages carrying cues of authority were more likely to draw a response. Accounts payable staff, who process many messages and are expected to respond promptly to senior managers, sit at the intersection of both risks.

These findings suggest that training, though useful, cannot carry the full burden. If employees comply because the message fits their routine and carries authority, the defense should interrupt the routine at the point of payment. Three controls do that. First, any change to a vendor's bank details, and any payment request received by email, should be verified by a callback to a phone number already on file, never to the number in the email. Second, wire transfers above a set amount should require approval by two people, one of whom did not receive the request. Third, the company should apply the analytics we have been reading about to the payments file, flagging payments to bank accounts changed within the previous thirty days, first-time payments to new accounts and payments made outside the normal payment run. Nigrini (2011) shows how tests of this kind can be built from ordinary transaction data, and here they target the exact moment the scheme depends on.

Technical controls still help. Email authentication standards make it harder to spoof a company's own domain, and banners that mark external messages remind employees when a supposed executive is writing from outside. These measures reduce the number of convincing messages, but a compromised vendor account sends genuine email from the vendor's real domain, which no filter will stop. That case is why the payment controls come first.

Consider a simple scenario. An accounts payable clerk receives an email from a long-standing supplier announcing a new bank and attaching a letter on letterhead. A callback to the supplier's known number reveals that the supplier has not changed banks, and the payment is held. Without the callback, the next three invoices would have been paid to the fraudster, and the company would have learned of the loss only when the real supplier asked why it had not been paid.

My question for classmates: in your workplaces, are vendor bank changes verified by callback, and if so, does anyone check that the callback was actually made before payment is released?

References

Cross, C., & Gillett, R. (2020). Exploiting trust for financial gain: An overview of business email compromise (BEC) fraud. Journal of Financial Crime, 27(3), 871-884. https://doi.org/10.1108/JFC-02-2020-0026

Federal Bureau of Investigation. (2024). Internet crime report 2023. Internet Crime Complaint Center.

Nigrini, M. J. (2011). Forensic analytics: Methods and techniques for forensic accounting investigations. Wiley.

Vishwanath, A., Herath, T., Chen, R., Wang, J., & Rao, H. R. (2011). Why do people get phished? Testing individual differences in phishing vulnerability within an integrated, information processing model. Decision Support Systems, 51(3), 576-586. https://doi.org/10.1016/j.dss.2011.03.002

Williams, E. J., Hinds, J., & Joinson, A. N. (2018). Exploring susceptibility to phishing in the workplace. International Journal of Human-Computer Studies, 120, 1-13. https://doi.org/10.1016/j.ijhcs.2018.06.004