Business name abuse is a growing problem

Money lost to fraud triples in first six weeks of 2022

Entrepreneur looking worried at his laptop

In the first six weeks of 2022, scams costing a total of ten million euros were reported to the Fraud Help Desk, the Dutch national report desk for deceptive sales practices. That compares with just three million in the same period of 2021. Most of the reported cases involved the abuse of company names for CEO fraud, scam calling and the like. The upsurge provides further evidence of the need for better online security.

What is CEO fraud?

CEO fraud gets its name from the fact that, in the early days, it typically involved crooks pretending to be the chief executives of big businesses. They would contact a member of staff and instruct them to arrange a large transaction, sending money to the scammer's bank account. Another name for the practice is business e-mail compromise (BEC) fraud. Perhaps the best-known CEO fraud in the Netherlands was the Pathé case. The crooks behind such frauds invest considerable time and money in preparing each attempted scam, so they aim high with the transaction values.

Rotterdam steel company tricked out of eleven million

Just how high the fraudsters aim was emphasised last month, when we learnt that Rotterdam steel company Jewometaal had lost eleven million euros to someone posing as CEO of the firm's German parent company. The scam was carefully timed for the day after the Chief Financial Officer had gone on holiday.

More victims

In recent times, it's become apparent that fraudsters are casting their nets more widely. Other sectors of the economy and other types of organisation are being targeted. Student associations whose officers change every year, for example. And political parties' campaign offices. Crooks have also trained their sights on wholesalers, recognising that a lot of big wholesale transactions are arranged informally, sometimes without robust verification procedures.

CEO fraud and domain names

We often see that CEO frauds are carried out using e-mail addresses at specially created domains, such as https://naamleverancier-facturen.nl. The domain names in question give the fake invoices a bona fide look and encourage the recipient's trust. Fortunately, many malicious domain registrations can be picked up early using SIDN BrandGuard.

E-mail security standards

Another tactic favoured by cybercriminals is mail spoofing. That's where a weakness in an insecure mail system is exploited to make it look as if an e-mail comes from a legitimate address. Standards are now available that make it possible to check whether an e-mail address is genuine. Sadly, however, many organisations have yet to adopt the mail protocols in question.

Want to know more?

We regularly share information on sidn.nl about CEO fraud and how to protect against it. For all the latest news direct to your mailbox, subscribe to our Domain names, security and brands newsletter.