Hacker News Reader

Comment by vermontdevil | Hacker News Reader

Shouldn't companies have controls in set when large amount of money is being requested for transfer? Controls that does not involve using email as final approval.

View on HN

Emails are regularly used for approving large transactions. You can have dedicated approval systems but they are often more of a problem than a solution. When the approver is away you have complex and slow delegation procedures when you are not completely stuck. When people are travelling they can't approve anything while they can on a blackberry. And you need to email people to chase them anyway. These systems are just adding to the corporate bureaucracy.

Common sense should be the first line of defense. Even by email, managers should not approve a transaction they know nothing about. And if one approves somethings after having only talked to complete strangers, it's hard to fight raw stupidity. The first think I would have done in this story is fire the accountant.

Absolutely agree.

> "My accountant was called on Friday morning," she tells the BBC. "Someone said: 'You're going to get an email from the president, and she's going to give you instructions to conduct a very confidential transaction and you're going to have to respond to whatever instructions she gives you'."

This should have thrown up so many red flags for anyone. Crazy.

It's just a numbers game. There are suckers born every minute. There are an unbelievable number of accountants out there who couldn't put together these obvious signs.

A phone call from a stranger and an email from an account that has her name in it... it was probably CEO@imstealingyourmoney.ru

It's easy to fake from address. So, it's going to be CEO@yourconpany.com

Agreed with my sibling post, that email would probably get flagged and dropped as spam before it got to the accountant.

I've seen an email like this aimed at the company I work for and it was something like ceo@yourrcompany.com (just one letter was doubled from the real domain).

I think you both missed:

Conpany vs Company

Which just demonstrates how easy it is to get this past people.

PS: That or you where just assuming that was an error on my part ops. I did briefly correct it before realizing it was a better example.

If it was flagged as spam it would probably be due to a misconfiguration on the fraudster's end. There might be some anti-spam systems that might be looking for this now but I've yet to see it listed as a feature.

What major email service would allow that email to pass through into the accountant's inbox with no warning? I guess if you're stupid enough to transfer the money, you're stupid enough to ignore the warnings on the email.

This is a serious question just as a FYI.

Why would an email service know that conpany.com is a scam address of company.com? If they were spoofing addresses then it may be detected, but if they are using a valid domain with a random letter changed you are out of luck unless you have common sense and pay a lot of attention.

There are many things that can be done to prevent this and likely often are. I've set my mail client to color the subject line of messages differently if the from address is in my addressbook or not. However, I don't know how common it is for mail clients to do things like that by default so there may be many people who don't have any obvious sign that something is wrong.

ETA: I think some slight variations on the domain name could also be filtered out completely, but I'd guess it would be hard to catch all of those that it is difficult to visually detect without also filtering legitimate mail.

There is a huge cultural/generational component to it. There are some people who you just cannot wire to be suspicious. Either hire the right people or build security into your processes.

That's funny, my first thought was to fire the accountant as well. Then I thought about it, who has more experience with these scammers than the accountant that screwed up? I would wager they would never fall for it again if they were any sort of reasonable human being- whereas a new accountant has probably never even heard of this scam and you're vulnerable all over again.

What I would do, though, is get my lawyer involved to write up a new contract that would make them liable for every last penny should this happen again.

> What I would do, though, is get my lawyer involved to write up a new contract that would make them liable for every last penny should this happen again.

No accountant would work for you with that stipulation, the risk/reward calculation doesn't make sense.

Not true, my accountant has a contract where she is responsible for any mistakes or miscalculated taxes etc so she has to pay them. She does have a registered accountancy office though and insurance against this sort of thing though so the risk for her is also minimal.

That doesn't sound like an in-house accountant (i.e. an employee) but that you are engaging an external accountant to work for you - completely different commercial relationships.

And they typically have liability insurance anyway. Your contract is not worth the paper it's written on if the accountant is unlikely to be able to ever repay the loss.

"When called into Watson's office, the fellow said "I suppose you want my resignation." Watson looked at him and replied: "Are you kidding? We just spent ten million dollars educating you." "

Accountants who have let this happen should put the fact on their resume or CV. It will make them more appealing to hire since they are not likely to repeat that kind of mistake.

In reality, this is probably true, but HR would never let that resume through.

"Expertise in security processes and stipulations for large transactions and accounting operations", there you go. If they ask in the interview, say it happened to a colleague sitting next to you and you learned a lot from it.

An accountant who has honesty issues. Makes for a good sales pitch.

> Then I thought about it, who has more experience with these scammers than the accountant that screwed up?

On the other hand, sometimes people fall for scams because they are extremely gullible and they never learn. e.g. http://www.neogaf.com/forum/showpost.php?p=36572169

Does the professional body fr accounting not have anything to say - if a Medic is grossly incompetent they can get struck off for life - as can bankers if they realy screw up

Emails should not be used to approve six figure cash transactions. An account reconciliation or approval of PTO? Sure.

You can easily set up your online banking to require one individual to intiate a wire transfer, and a separate individual to approve the transaction. This is a very basic financial control.

My guess is the companies falling victim to this don't have any formal controls in place.

It all depends on the size of the company and the stupidity of the accounting/purchasing department. The article describes the fraud ranging from modest to sizable. It's not uncommon for many business to have 50k transactions every week. You don't want to go around getting approval for every transaction every day. It's not uncommon for many businesses to have 300k transactions every month.

The business that lost 30m+ I don't understand... It must have been multiple wires over a period of time. They found some vulnerable accountant with the power and just milked them over time.

Not all transactions are created equal. Six figure cash disbursement transactions should require approval.

And any company that has so many six figure cash disbursement transactions that approving them is an administrative burden is the type of company that most needs this kind of control in the first place.

I have seen emails regularly used to approve 9 and 10 figures transactions. But the approval always knew about the transaction, had talked about it with the relevant manager. And often would double check with the manager they trust that everything is in order.

Can you elaborate at all what kind of billion dollar transactions a manager is approving?

Releasing the funds on a loan, issuing a bond, redeeming a bond, etc.

> Emails are regularly used for approving large transactions.

In a corporation at least you can require an electronic signature, which requires you to provide your network credentials. Of course you have to have implemented this.

I have to electronically sign my PTO requests, for example.

Or at least use signed emails?

I was considering it [PGP] last year for company emails but the largest sums I deal with is £100s, if I was controlling £1000s plus based on email transactions I'd think signed emails (in both directions) would be absolutely required.

    -----BEGIN PGP SIGNED MESSAGE----- 
    Hash: SHA1

Very few people verify signatures. Most implementations are impossible for most people. Including a signature may increase risk by leading to false sense of security.

Hey, I recognize that gobbledygook. Those random letters and numbers mean I can trust whatever you say, right?

No, it means that there is a way with which you can verify whether you can trust or not.

Yes, I understand how you meant it. By I really can't understand ordinary people can even come to "your" conclusion. How can people be so stupid (sorry for my harsh wording) not to be able to understand that a digital signature just means that there exists a possibility to check whether the message is authentic (and this has to be done if necessary) instead of being authentic?

Because its just noise to non-tech people.

It's the same reason why email accounts have 2,000 unread inbox messages or 30 notifications at the top of their phone. You get so used to seeing the notification that you begin to ignore it. In this case, you see a string of non-readable text that makes up some weird "signature" at the bottom. The conclusion? "Oh. The signature is there. It's been authentic every other time I checked. Why wouldn't it be authentic on the 101st check?"

Humans are the hardest vector to defend in an attack. Never underestimate the laziness of people - even when a simple solution exists to combat the problem at hand.

But shouldn't one's email program handle all that in the background, so you get the equivalent of a browser's padlock icon showing whether authentication has been successful rather than getting the PGP (or whatever). Yes, there will still be ways around people but this seems like it should be a standard and basic part of all email programs now.

This is probably the most elegant solution to a PGP signature.

> this seems like it should be a standard and basic part of all email programs now

I can't speak with authority on this, but it feels like this would be adding overhead to something that doesn't necessarily need it. Email is supposed(!) to be relatively simple. I can think of many cases where you would definitely want to have PKI integrated into your emails, but I can think of just as many cases where it's unnecessary overhead in email clients as a standard. However, I admit that I could be wrong.

I agree that it would make sense to add this functionality to the core of the email program. But this is a UI problem (i.e. it makes things that have been understood more comfortable), but does not change whether or not you have understood what a signature means.

Just the other day there was an article on Kevin Mitnick, this kind of attack is a malicious version of what he used to do ("Social Engineering")

https://news.ycombinator.com/item?id=10796950

http://henrikwarne.com/2015/12/27/social-engineering-from-ke...

GnuPG tells me that it's gobbledygook :)

Wouldn't simply signing mail be enough?

Reply on news.ycombinator.com