> "My accountant was called on Friday morning," she tells the BBC. "Someone said: 'You're going to get an email from the president, and she's going to give you instructions to conduct a very confidential transaction and you're going to have to respond to whatever instructions she gives you'."
This should have thrown up so many red flags for anyone. Crazy.
A phone call from a stranger and an email from an account that has her name in it... it was probably [email protected]
I've seen an email like this aimed at the company I work for and it was something like [email protected] (just one letter was doubled from the real domain).
Conpany vs Company
Which just demonstrates how easy it is to get this past people.
PS: That or you where just assuming that was an error on my part ops. I did briefly correct it before realizing it was a better example.
This is a serious question just as a FYI.
ETA: I think some slight variations on the domain name could also be filtered out completely, but I'd guess it would be hard to catch all of those that it is difficult to visually detect without also filtering legitimate mail.
What I would do, though, is get my lawyer involved to write up a new contract that would make them liable for every last penny should this happen again.
No accountant would work for you with that stipulation, the risk/reward calculation doesn't make sense.
On the other hand, sometimes people fall for scams because they are extremely gullible and they never learn. e.g. http://www.neogaf.com/forum/showpost.php?p=36572169
You can easily set up your online banking to require one individual to intiate a wire transfer, and a separate individual to approve the transaction. This is a very basic financial control.
My guess is the companies falling victim to this don't have any formal controls in place.
The business that lost 30m+ I don't understand... It must have been multiple wires over a period of time. They found some vulnerable accountant with the power and just milked them over time.
And any company that has so many six figure cash disbursement transactions that approving them is an administrative burden is the type of company that most needs this kind of control in the first place.
In a corporation at least you can require an electronic signature, which requires you to provide your network credentials. Of course you have to have implemented this.
I have to electronically sign my PTO requests, for example.
Common sense should be the first line of defense. Even by email, managers should not approve a transaction they know nothing about. And if one approves somethings after having only talked to complete strangers, it's hard to fight raw stupidity. The first think I would have done in this story is fire the accountant.