It will show up somewhere in the tax filings. There's no such thing as discreet payments unless it's in such small amounts that it comes from petty cash.
And since the ransomers are demanding payment in crypocurrency, it's even easier to spot for the clear majority of victims.
Create a shell company in some remote tax haven with lax disclosure laws, have them pay the ransom, and close the shell company afterwards. Companies are already good at dodging taxes this way.
That only works for hiding income, not hiding expenses.
You create a shell company in Malta (for example). Now how do you get $$$ into that company so that it can pay the ransom?
Okay, so you assign your payment to $MALTA-COMPANY the line-item of 'consulting fees'. It only takes a few companies to do this before the tax authorities are wise to it.
After all, even for relatively tiny amounts companies still have to perform KYC on customers!.
Think about it this way: if it was that easy to hide expenses from authorities, embezzlement schemes would be a lot simpler than they are now.
Tax authorities already don't give a fuck about where a company shifts its money to. As long as there's a proper entry in the books, at least. There are schemes involving up to six different legal entities [1]. A measly million dollars or two is a minor rounding error for a multibillion dollar company.
> Think about it this way: if it was that easy to hide expenses from authorities, embezzlement schemes would be a lot simpler than they are now.
Embezzlement is easier the higher the embezzler is in the command chain. When the CFO orders something to happen - say, a monetary transfer or the creation of a shell company - it will usually be executed without question by the lower levels. Maybe, given the rise of impersonation attacks, the underlings will follow protocol and call the CFO back to verify that it is really the CFO ordering that thing, but that's it.
If I were to guess, 90% are accepted at face value, 10% are flagged for some irregularity and 1% are audited in detail.
Independent auditors check to see if a company's accounting is following GAAP accounting standards (so that a statement can be put in the SEC filings). They don't comb through each payment in detail (corporations can have millions of them each year). And if they find things, they tell the company to fix it or report any deviation from GAAP standards.
But much of it is dependent on good faith of the company along with some spot checking to see if their accounting processes line up with what they said they do.
And plenty of companies who have been found to commit fraud have gotten the "thumbs up" during their "independent audit". It gives you a sense as to how cursory their audits are.