Product Family


Crime Regional Leader - North America

One of the oldest forms of crime — the con — is causing massive losses for businesses and individuals. The basic tactic in these increasingly sophisticated schemes is social engineering, in which criminals persuade victims to help the fraudsters obtain access, data or money.

Topping the list in financial losses in the Federal Bureau of Investigation’s 2017 Internet Crime Report is what the FBI calls “business email compromise/e-mail account compromise.” In 2017, BEC/EAC incidents took $676.2 million from 15,690 victims. “Confidence fraud/romance,” was second on the list, generating $211.4 million in losses from 15,372 victims.

The FBI and other federal authorities in June announced the culmination of a six-month coordinated operation to stop international BEC schemes. Operation WireWire resulted in 74 arrests, the seizure of $2.4 million and the recovery of $14 million in fraudulent wire transfers.

Since the FBI’s Internet Crime Complaint Center began tracking BEC/EAC, victims have reported losses totaling more than $3.7 billion. Because many crimes go unreported, these numbers on social engineering fraud may be only the tip of the iceberg.

Social engineering fraud tends to fall into three main categories, each of which can harm a business’s balance sheet and reputation:

Vendor impersonation. Vendor impersonation has become a frequent loss as fraudsters persuade victims to divert recurring payments to new bank accounts or pay bogus invoices. These scams succeed when unsuspecting recipients don’t verify details or check existing records.

Executive impersonation. Less common than vendor impersonation but with much higher stakes, executive impersonation is a highly sophisticated con game, often using data stolen through phishing or other means to earn trust and create plausible scenarios, such as a foreign subsidiary’s acquisition requiring release of funds. Common elements in these scams include urgency and pressure to avoid displeasing senior management. Numerous companies have been defrauded of tens of millions of dollars through this crime.

Client impersonation. These losses have tended to be smaller, but they also are rising. The scams typically target professional services firms and involve overpayments by fake but official-looking checks. Fraudsters ask the firm to remove their retainer and send back the remainder.

Fraud risk mitigation

Variants exist for nearly all types of social engineering, and criminals adapt their tactics, but businesses can mitigate the risk. Three key elements are:

  • People. The first line of defense is training employees to recognize potential frauds, whether phishing e-mails or calls from someone purporting to be a vendor, client or company executive.
  • Processes. Creating a convenient way to report suspicious activity, such as sending dubious e-mails to a folder the IT department investigates, can reduce the chance that employees will inadvertently help criminals.
  • Technology. Computer security solutions continue to improve. For example, some tools let corporate systems set apart Internet browsers in a “sandbox” so malware cannot infect the network. Two-factor authentication with a time-sensitive passcode sent to a user’s cell phone reduces the risk of fraudsters obtaining access to data with only a computer password.

Social engineering attacks are likely to continue, but smart risk management can help businesses stay ahead of the criminals.

Originally published in Risk & Insurance.

To contact the author of this story, please complete the below form

Invalid First Name
Invalid Last Name
Country is required
Invalid email
Invalid Captcha

More Articles

Global Asset Protection Services, LLC, and its affiliates (“AXA XL Risk Consulting”) provides risk assessment reports and other loss prevention services, as requested. This document shall not be construed as indicating the existence or availability under any policy of coverage for any particular type of loss or damage. AXA XL Risk. We specifically disclaim any warranty or representation that compliance with any advice or recommendation in any publication will make a facility or operation safe or healthful, or put it in compliance with any standard, code, law, rule or regulation. Save where expressly agreed in writing, AXA XL Risk Consulting and its related and affiliated companies disclaim all liability for loss or damage suffered by any party arising out of or in connection with this publication, including indirect or consequential loss or damage, howsoever arising. Any party who chooses to rely in any way on the contents of this document does so at their own risk.

US- and Canada-Issued Insurance Policies

In the US, the AXA XL insurance companies are: AXA Insurance Company, Catlin Insurance Company, Inc., Greenwich Insurance Company, Indian Harbor Insurance Company, XL Insurance America, Inc., XL Specialty Insurance Company and T.H.E. Insurance Company. In Canada, coverages are underwritten by XL Specialty Insurance Company - Canadian Branch and AXA Insurance Company - Canadian branch. Coverages may also be underwritten by Lloyd’s Syndicate #2003. Coverages underwritten by Lloyd’s Syndicate #2003 are placed on behalf of the member of Syndicate #2003 by Catlin Canada Inc. Lloyd’s ratings are independent of AXA XL.
US domiciled insurance policies can be written by the following AXA XL surplus lines insurers: XL Catlin Insurance Company UK Limited, Syndicates managed by Catlin Underwriting Agencies Limited and Indian Harbor Insurance Company. Enquires from US residents should be directed to a local insurance agent or broker permitted to write business in the relevant state.