There are a number of resources in the U.S. who collect data about cybercrime, and the FBI’s Internet Cybercrime Complaint Center is one of them. The Internet Crime Complaint Center (IC3) is an excellent source of information about trending cybercrimes and statistical data about cybercrimes perpetrated in the United States.
For example, cybercrimes reported to the IC3 cost victims almost $7 Billion in 2021. The costliest type of cybercrime, at almost $2.4 Billion, is known as Business Email Compromise (BEC) or Email Account Compromise. The second costliest cybercrime in 2021 was investment scams and fraud, at more than $1.4 Billion.
Many of these cybercrimes rely on phishing schemes and similar social engineering techniques to dupe individuals into inadvertently assisting the cybercriminals.
Business email compromises are a cybercrime that targets organizations who regularly conduct wire transfers as part of their business. First, the scammer gains access to an email account belonging to an employee—often located in the finance department—in order to learn about the vendors used by the organization. Access may have been made possible through hacking, or a phishing or spear-phishing ploy, or other social engineering techniques.
This cybercrime is also sometimes known as CEO fraud because scammers often spoof the name and email address of the employee’s CEO or some other C-level executive. Many organizations display their C-suite on the Leadership page of the website, complete with executive biographies and photos. This makes it easy for a scammer to research an executive in order to spoof him or her more realistically. It’s no wonder that a general employee, upon seeing an urgent email from an executive, would act quickly to fulfill the request.
Often, business email compromise schemes can be identified before any damage is done, provided employees know what to look for. Following are some tips you can share with your employees, courtesy of the FBI and IC3.
These employee awareness tactics will help avoid business email compromises in most cases. And there are additional email safeguards you can implement to better protect your organization and employees.
However, in the event that your organization is victimized, it’s important to act quickly. Contact your financial institution immediately and request that they contact the financial institution where the transfer was sent, to advise them of the scam. Then, contact your local FBI field office to report the crime, and file a complaint with the Internet Crime Complaint Center (IC3).
Remember, business email compromises were the #1 cybercrime reported in 2021 and cost nearly $2.4 Billion. Don’t take them lightly.
Much of the data collected by the IC3 can be sorted by various parameters, including state. In 2021, for example, Florida had 1,546 victims of business email compromises. BEC was #8 on the top ten list of cybercrimes in Florida, as reported to the IC3—but was #1 in terms of cost to victims, at more than $192 Million for the year.
Among the more prevalent cybercrimes in Florida were identity theft (with 8,225 victims reported), non-payment or non-delivery scams (6,194), personal data breaches (4,132), cyber extortion, which includes ransomware (2,541), and phony tech support scams (2,110).
Who hasn’t had a call from a concerned voice (foreign), claiming to be Steve or Dave or Mike (not), informing you that your computer has been compromised (it hasn’t) but they can easily fix it for you? (We all have, no doubt.) Simply share your screen or grant Dave access and he’ll take care of it. (And will he ever!)
In addition to other demographics, the Internet Cybercrime Complaint Center also tracks financial losses by age group. In Florida, the greatest losses were sustained by victims over 60 years of age, who collectively lost more than $168 Million to cybercrime last year. Victims aged 40 to 49 suffered slightly more crimes, but their losses were only about one-third of those of the over-60 victims.
2021 was also a banner year for certain robocalls. For the second consecutive year, the top robocall complaint filed with the Federal Communications Commission was the ubiquitous Auto Warranty Renewal call. These calls often include details about your particular car so that they seem more legitimate.
Most consumers reported that the unwelcome warranty calls include an automated or prerecorded message instructing them to press a certain number to speak with a live operator about their warranty, or to press a certain key to remove themselves from the call list.
With robocalls that offer these options, Don’t Press That Key! As much as you want to believe that good will come of it, pressing that key will simply lead to more robocalls because you have just verified to the robocall center that your phone number is valid and active. And that makes you an attractive target for future robocall scams.
Other common robocall scams in 2021 included calls phishing for social security numbers or credit card numbers. Calls offering fake insurance and phony healthcare benefits. And calls advising that you have been named in a (fake) lawsuit, or that criminal charges (fake) have been brought against you. These scams and others rely on creating fear, uncertainty, and doubt in the minds of their targets—so keep your guard up and put your phone down.
Most robocalls target residential landlines and cell phones, although a few scams also target small businesses. The FCC has provided the following guidance for protecting yourself from annoying, and potentially dangerous, robocalls.
There are a number of resources in the U.S. who collect data about cybercrime, and the FBI’s Internet Cybercrime Complaint Center (IC3) is one of them. Of all the cyber crimes reported to IC3 in 2021, business email compromises, or compromises of email accounts, topped the list in terms of the financial cost. Business email compromise schemes target organizations who routinely conduct wire transfers as part of their business.
Business email compromises cost victims close to $2.4 Billion in 2021, which is more than one-third of the total cost of all cybercrimes reported to the IC3 in 2021. Organizations who frequently wire payments to vendors, for example, should be aware of the popularity of this cybercrime and the precautions they can take to reduce their likelihood of being victimized. Training employees to be aware of email and phone phishing schemes, and how to identify them, is a good place to start.