There’s yet another new, and nasty, ‘phishing’ attack doing the rounds. We’ve heard it called SpearPhishing, or Whaling. Here’s how it works.
The villains research the name of your CEO and your accountant/CFO. This is often just a matter of looking on your website for the names. Then they send the accountant an email, pretending to be from the CFO.
They are very clever at how they spoof this, picking an email address that’s close enough to be legitimate that you are fooled unless you look really carefully. The CFO replies – the (fake) ‘CEO’ responds with the necessary details and confirms the instructions. The poor accountant thinks they are getting a legitimate instruction from the CEO. Here’s an example we saw last week from a client (read it from the bottom up)
These villains are very clever. The emails look credible, especially given that they purport to come from something like an iPad, that means the reader forgives the poor formatting and spelling errors. The messaging is credible, but the dollar amount is enough to raise flags. Imagine if it were a smaller amount!
Luckily in this case, our client’s CFO was much too alert and they picked up on the scam straight away. It’s clearly fairly widespready – we noticed NBR reporting it as well, so it’s doing the rounds! In the meantime, just as this client did, manually verify the instruction – send a new email (don’t just reply) or phone the person.