ACCT 660 Week 6 Discussion Board Forum 3 Replies Example

Discussion Board Forum 3 Replies: Responding to Classmates on Cyber Fraud

ACCT 660 Information Technology and Fraud, Discussion Board Forum 3 Replies

Thread by [Student Name]

The classmates and their threads are composites; the studies cited are real.

Reply to Kevin

Kevin, your thread argued that regular security awareness training is the best defense against phishing and the business email compromise schemes that follow it. I agree that employees need to understand these schemes, but research suggests that the most common form of training may do less than we assume. Lain et al. (2022) ran a study lasting more than a year with over fourteen thousand employees of one company, sending simulated phishing emails and showing short training material to those who clicked. Employees who received that embedded training were not more resilient afterward, and in some measures they did worse. What did work was employee reporting: a large share of the workforce reported suspicious messages, and those reports arrived quickly enough to help the security team respond.

This fits what we know about why people click. Vishwanath et al. (2011) found that habitual, high-volume email handling made people more likely to respond to phishing. Training aimed at a habit competes with the same habit every time the inbox fills. Making reporting a one-click habit uses that routine instead of fighting it. The same study found that reports from colleagues often reached the security team within minutes of a campaign starting, which means a well-trained reporting culture can protect even the employees who do click, because the message is removed from inboxes before most people open it.

So I would keep training but shift the emphasis toward easy reporting and fast feedback. My question for you: in your organization, how would you encourage employees to report a suspicious message even when they are not sure, without making them feel foolish if it turns out to be legitimate?

Reply to Alicia

Alicia, your thread said that once fraudsters convert stolen funds into cryptocurrency, the money becomes untraceable. I think the picture is more hopeful for investigators. Bitcoin's ledger is public, so every transaction between addresses can be seen by anyone. Meiklejohn et al. (2013) showed that addresses used together as inputs to one transaction can be grouped as belonging to the same user, and that by transacting with known services they could label many of those groups with real-world identities, such as exchanges and online services.

Other researchers have used those methods at scale. Foley et al. (2019) applied network analysis to the bitcoin blockchain and estimated that a substantial share of users and transactions in the period they studied were associated with illegal activity, an estimate that was possible only because the transactions could be traced. The weak point for a criminal is usually the exchange where crypto is converted to dollars, since regulated exchanges collect customer identification that investigators can obtain through legal process.

Tracing does have limits, including privacy coins and mixing services. Still, for an examiner the practical point is that a conversion to cryptocurrency usually adds steps to an investigation rather than ending it, and the records held by the victim's bank, the receiving bank and any exchange involved are often enough to connect the stolen funds to a specific address. My question for you: in a business email compromise case, what records would an examiner need from the victim company and its bank to link the stolen wire to a particular blockchain address in the first place?

References

Foley, S., Karlsen, J. R., & Putnins, T. J. (2019). Sex, drugs, and bitcoin: How much illegal activity is financed through cryptocurrencies? The Review of Financial Studies, 32(5), 1798-1853. https://doi.org/10.1093/rfs/hhz015

Lain, D., Kostiainen, K., & Capkun, S. (2022). Phishing in organizations: Findings from a large-scale and long-term study. In 2022 IEEE Symposium on Security and Privacy (pp. 842-859). IEEE. https://doi.org/10.1109/SP46214.2022.9833766

Meiklejohn, S., Pomarole, M., Jordan, G., Levchenko, K., McCoy, D., Voelker, G. M., & Savage, S. (2013). A fistful of bitcoins: Characterizing payments among men with no names. In Proceedings of the 2013 Internet Measurement Conference (pp. 127-140). ACM. https://doi.org/10.1145/2504730.2504747

Vishwanath, A., Herath, T., Chen, R., Wang, J., & Rao, H. R. (2011). Why do people get phished? Testing individual differences in phishing vulnerability within an integrated, information processing model. Decision Support Systems, 51(3), 576-586. https://doi.org/10.1016/j.dss.2011.03.002