VERNESA HARPER: My role is dedicated to keeping you and your firm aware of fraud and cybersecurity threats that you may encounter. Today, I want to bring attention to a common fraud scheme impacting advisors and clients, business email compromise, which is also known as email account compromise. Scammers know that you and your clients rely on email to conduct business, which is the same reason that email is the number one gateway to cybercrime.
This scheme is carried out when a fraudster compromises a legitimate business or personal email account through social engineering or computer intrusion techniques, malware, for example, to request unauthorized transfers of funds.
Once the fraudster has access to the client's email account, they will search to see if the client has a relationship with an advisor. Fraudsters will piggyback on an existing email conversation between the advisor and the real client a request to send an outgoing transaction to an account that the fraudster controls.
One of the tricks that sophisticated fraudsters use is spoofing the client's email address, which happens when they create a new account that looks very similar to the client's real email address. Then the fraudster sends an email from this new email address to the advisor posing as their client to request an outgoing fraudulent transaction.
We've also seen fraudsters leverage a relationship between a client and some third party. The end goal is to get the advisor to facilitate a fraudulent outgoing transfer from the client's account. Let's look at some red flags to watch out for.
The first red flag is a spoofed email address. As mentioned earlier, the fraudster will create an email address that looks very similar to the client's real email address.
The second red flag is fraudsters will piggyback on existing email communications with the advisor. Look for an abrupt change in the email tone.
The third red flag is creating a sense of urgency. Every email request from a fraudster is supposedly urgent, and fraudsters will try to play on the advisor's emotions to get them to act quickly.
The fourth red flag is inconsistent grammar or spelling errors.
The fifth red flag is attempting to limit communication to email. The fraudster will come up with reasons as to why they're unable to get on the phone with you to verbally verify the request, using the excuse that they only have access to their email.
The sixth red flag, the money movement instructions are sent in an email followed by a new set of instructions that are sent by the fraudster.
And the seventh and last red flag is the transaction is rejected by the receiving bank.
Schwab requires advisors to call clients to verbally verify the details of all money movement instructions, especially email, before sending the instructions to Schwab. Fraudsters succeed in their schemes when an advisor acts on fraudulent money movement instructions without verbally verifying them with their client, resulting in a successful email compromise fraud incident.
The Schwab Security Guarantee doesn't cover fraud loss when the money movement activity is facilitated by the advisor. In these cases, the advisor is liable for the loss in their client's account.
The verbal verification is not just a Schwab requirement, but most insurance companies require it, as well.
Let's talk about how you can protect your firm and your client assets. Assume the email is fraud until you can prove that it's not. Look for spoofed email addresses. Avoid sharing confidential information in an email. Verbally verify all money movement instructions received in an email with your client. Encourage your clients to utilize two-factor authentication, which is an added layer of security for email accounts. And, lastly, utilize the eAuthorization channel, which is the fastest and safest way to move money in your client's account.
If your client becomes the victim of the email account compromise scheme, please contact Schwab immediately and we will reach out to the receiving firm to recall the funds.
