CEO fraud is a growing problem

CEO fraud: the numbers

We tend to associate CEO fraud with occasional high-profile incidents involving the theft of millions. The reality is that it's now a generalised, mundane phenomenon. Research by Proofpoint found that 92 per cent of all organisations had been targeted. Although the vast majority of attempted scams fail, that doesn't deter the criminals. "From the scammer's viewpoint, the business case for CEO fraud is persuasive," says Jan Martijn Broekhof. "It costs them very little. So they can afford to keep sending their mails to one organisation after another, day after day. If one of them takes the bait every once in a while, that's enough to make the practice pay. It's also a low-risk enterprise. There's very little law enforcement in this field, and the crooks can easily cover their tracks by using cryptocurrency."

Heroes, not scapegoats

As CEO fraud illustrates, a human is often the weakest link in the cybersecurity chain. Having fallen for a scam, a worker will often respond by doing things that are ultimately unhelpful. Fearing disciplinary action or dismissal, they'll keep quiet and hope that no one finds out. However, the information released by Meierijstad made it clear that the municipality was providing support and counselling to the duped personnel. Jan Martijn Broekhof endorses that approach. "Rather than being thrown under a bus, staff should be treated as heroes," he says. "Companies are targeted by phishing scammers every day, and 99 per cent of the time the scams fail, because people do the right thing. That's what should be emphasised. Every week that passes without an incident is a success. Another relevant point is that, when things go wrong, the problem often isn't the person who has been duped, but the process that allowed it to happen. If you've got a well-designed process, based on PO numbers and two-person authorisation, it's much harder to extort money, especially if you build in technical safeguards as well. An organisation needs to stick to its procedures, even when executives and proprietors are involved."

Closing the door to phishing

Improvements can also be made at the point of entry. By implementing open e-mail security standards, setting up spam filters and configuring its mail gateways, an organisation can make it less likely that phishing mail will reach its staff. For example, Microsoft's widely used office software packages allow mail to be flagged up if it originates outside the organisation. That reduces the risk of anyone falling for a scam where a typo domain is used to send mail that looks as if it comes from someone inside the recipient's organisation. Services such as the SIDN-developed CyberSterk and SIDN BrandGuard can also reduce vulnerabilities.

Openness

But what if, despite everything, the organisation does get scammed? Should the incident be hushed up? Jan Martijn Broekhof argues that concealment is counterproductive. "No one feels embarrassed if they get burgled. But falling for a scam is something people don't like to own up to. But they should do, really, because open internal and external communication is needed to educate others. And, in practice, the reputational damage caused by an incident isn't usually as bad as people fear. In the case of a municipality, the fact that public money is involved is another reason for openness."