Protect Your Business from Email Account Takeover

By Debbie Grimm
Vice President, Retail Banking

Email fraud is a growing concern for banks and their business accountholders. Email fraud, often referred to as Email Account Takeover or Business Email Compromise, begins when criminals gain access to an email account.  While this form of fraud is not new, we are seeing a resurgence, as scammers get more sophisticated.

At North American Banking Company, we take the security of our customers’ accounts seriously. Email fraud can affect your business in lot of ways, but we want to provide you with information on the email fraud scenarios we are seeing scammers use to gain access to your funds and provide some tips to combat these scenarios.

Impersonating a Vendor or Client

First, scammers can gain access to your funds by impersonating a vendor or client. They email you with updated banking information or wire instructions. The emails look legitimate and often include official letterhead or an invoice. From the email instructions, you change the banking information on an ACH entry or wire and funds are sent to the scammers.

To avoid falling victim to this fraud: Always verify new ACH banking information or wire instructions received through an email with a phone call to the recipient. Be sure to use a phone number you currently have on file and not the phone number provided in the email.

Posing as Senior Management or Coworker

Another way scammers use email to gain access to your funds is by posing as a member of senior management or coworker. Scammers send fake intracompany emails to subordinates to request wires or cashier’s checks be sent immediately. The sender usually expresses a sense of urgency in the email to complete the task. The sender also often states a reason why they are unable to complete the task themselves such as out of town or tied up in a meeting.

To avoid falling victim to this form of email fraud, slow down before you initiate that wire or request a cashier’s check from the bank. Does this request make sense? Check the email for vocabulary and misspelling. Check with another member of senior management or accounting staff to verify the payment. Call or text the sender’s cell phone to verify.

Emailing Your Bank

Finally, scammers are directing fraudulent emails to North American Banking Company. We are seeing these emails requesting bankers to change signers, reset passwords, wire funds and send cashier checks. These emails appear legitimate and often are directed to your favorite lender or banker.

North American Banking Company will not respond to an email request where your accounts or funds are involved without calling you to verify the validity of an email. We will use a number we have on file to reach you and verify your identity.

A few key pieces to take away: you can no longer assume emails are legitimate even coming from people you know are legitimate. The faster the transaction happens, the more likely the scammer will get your funds. Email fraud resulted in losses estimated at $2.7 billion in 2022.

Tips to Avoid Email Account Takeover

• Don’t click on links in emails. Hover over links to see their true destinations. 
• Closely examine the sender address and the content of emails you receive. 
• Be suspicious of emails with new or one-time wire transfer instructions. 
• Use a verified contact phone number to call the email sender. 
• Follow all protocols for moving money or making payments, including real-time verification of the sender.