Hacker News Reader

Comment by cm2187 | Hacker News Reader

Emails are regularly used for approving large transactions. You can have dedicated approval systems but they are often more of a problem than a solution. When the approver is away you have complex and slow delegation procedures when you are not completely stuck. When people are travelling they can't approve anything while they can on a blackberry. And you need to email people to chase them anyway. These systems are just adding to the corporate bureaucracy.

Common sense should be the first line of defense. Even by email, managers should not approve a transaction they know nothing about. And if one approves somethings after having only talked to complete strangers, it's hard to fight raw stupidity. The first think I would have done in this story is fire the accountant.

View on HN

Absolutely agree.

> "My accountant was called on Friday morning," she tells the BBC. "Someone said: 'You're going to get an email from the president, and she's going to give you instructions to conduct a very confidential transaction and you're going to have to respond to whatever instructions she gives you'."

This should have thrown up so many red flags for anyone. Crazy.

It's just a numbers game. There are suckers born every minute. There are an unbelievable number of accountants out there who couldn't put together these obvious signs.

A phone call from a stranger and an email from an account that has her name in it... it was probably CEO@imstealingyourmoney.ru

It's easy to fake from address. So, it's going to be CEO@yourconpany.com

Agreed with my sibling post, that email would probably get flagged and dropped as spam before it got to the accountant.

I've seen an email like this aimed at the company I work for and it was something like ceo@yourrcompany.com (just one letter was doubled from the real domain).

I think you both missed:

Conpany vs Company

Which just demonstrates how easy it is to get this past people.

PS: That or you where just assuming that was an error on my part ops. I did briefly correct it before realizing it was a better example.

If it was flagged as spam it would probably be due to a misconfiguration on the fraudster's end. There might be some anti-spam systems that might be looking for this now but I've yet to see it listed as a feature.

What major email service would allow that email to pass through into the accountant's inbox with no warning? I guess if you're stupid enough to transfer the money, you're stupid enough to ignore the warnings on the email.

This is a serious question just as a FYI.

Why would an email service know that conpany.com is a scam address of company.com? If they were spoofing addresses then it may be detected, but if they are using a valid domain with a random letter changed you are out of luck unless you have common sense and pay a lot of attention.

There are many things that can be done to prevent this and likely often are. I've set my mail client to color the subject line of messages differently if the from address is in my addressbook or not. However, I don't know how common it is for mail clients to do things like that by default so there may be many people who don't have any obvious sign that something is wrong.

ETA: I think some slight variations on the domain name could also be filtered out completely, but I'd guess it would be hard to catch all of those that it is difficult to visually detect without also filtering legitimate mail.

There is a huge cultural/generational component to it. There are some people who you just cannot wire to be suspicious. Either hire the right people or build security into your processes.

That's funny, my first thought was to fire the accountant as well. Then I thought about it, who has more experience with these scammers than the accountant that screwed up? I would wager they would never fall for it again if they were any sort of reasonable human being- whereas a new accountant has probably never even heard of this scam and you're vulnerable all over again.

What I would do, though, is get my lawyer involved to write up a new contract that would make them liable for every last penny should this happen again.

> What I would do, though, is get my lawyer involved to write up a new contract that would make them liable for every last penny should this happen again.

No accountant would work for you with that stipulation, the risk/reward calculation doesn't make sense.

Not true, my accountant has a contract where she is responsible for any mistakes or miscalculated taxes etc so she has to pay them. She does have a registered accountancy office though and insurance against this sort of thing though so the risk for her is also minimal.

That doesn't sound like an in-house accountant (i.e. an employee) but that you are engaging an external accountant to work for you - completely different commercial relationships.

And they typically have liability insurance anyway. Your contract is not worth the paper it's written on if the accountant is unlikely to be able to ever repay the loss.

"When called into Watson's office, the fellow said "I suppose you want my resignation." Watson looked at him and replied: "Are you kidding? We just spent ten million dollars educating you." "

Accountants who have let this happen should put the fact on their resume or CV. It will make them more appealing to hire since they are not likely to repeat that kind of mistake.

In reality, this is probably true, but HR would never let that resume through.

"Expertise in security processes and stipulations for large transactions and accounting operations", there you go. If they ask in the interview, say it happened to a colleague sitting next to you and you learned a lot from it.

An accountant who has honesty issues. Makes for a good sales pitch.

> Then I thought about it, who has more experience with these scammers than the accountant that screwed up?

On the other hand, sometimes people fall for scams because they are extremely gullible and they never learn. e.g. http://www.neogaf.com/forum/showpost.php?p=36572169

Does the professional body fr accounting not have anything to say - if a Medic is grossly incompetent they can get struck off for life - as can bankers if they realy screw up

Emails should not be used to approve six figure cash transactions. An account reconciliation or approval of PTO? Sure.

You can easily set up your online banking to require one individual to intiate a wire transfer, and a separate individual to approve the transaction. This is a very basic financial control.

My guess is the companies falling victim to this don't have any formal controls in place.

It all depends on the size of the company and the stupidity of the accounting/purchasing department. The article describes the fraud ranging from modest to sizable. It's not uncommon for many business to have 50k transactions every week. You don't want to go around getting approval for every transaction every day. It's not uncommon for many businesses to have 300k transactions every month.

The business that lost 30m+ I don't understand... It must have been multiple wires over a period of time. They found some vulnerable accountant with the power and just milked them over time.

Not all transactions are created equal. Six figure cash disbursement transactions should require approval.

And any company that has so many six figure cash disbursement transactions that approving them is an administrative burden is the type of company that most needs this kind of control in the first place.

I have seen emails regularly used to approve 9 and 10 figures transactions. But the approval always knew about the transaction, had talked about it with the relevant manager. And often would double check with the manager they trust that everything is in order.

Can you elaborate at all what kind of billion dollar transactions a manager is approving?

Releasing the funds on a loan, issuing a bond, redeeming a bond, etc.

> Emails are regularly used for approving large transactions.

In a corporation at least you can require an electronic signature, which requires you to provide your network credentials. Of course you have to have implemented this.

I have to electronically sign my PTO requests, for example.

Reply on news.ycombinator.com