This scam relies upon a number of things, but they key is often a CEO’s willingness to boast. That might be anything from a posting on social media to a simple voicemail message or out-of-office email. (As an aside, I’m advised there is easy money to be made by harvesting ‘out -of-office’ emails and then simply selling them on to fraudsters who can exploit the situation)
I'm a big fan of 'The Apprentice' television show, and as a result I'm aware that being a budding CEO appears to demand that the size of their is ego inversely proportional to the amount of humility they possess. I must qualify 'big fan' - what I mean is that I find it amazing that there are people so hungry for fame that they are willing to evidence their abject lack of shame and ready willingness to stab fellow competitors in the back. I'd rather stick hot pins in my eyes than work for or with any of these people. That is why the voicemail greeting below is not untypical.
'I’m off to South East Asia for the next four weeks finalising a number of big ticket deals. First is Mumbai until the 9th, followed by Hong Kong until 21st and then Kuala Lumpur until the end of the month. If you have any difficulty getting in touch , please contact Abigail my Executive Assistant’
A couple of days later, the fraudster (posing as the CEO) emails the Chief Financial Officer (CFO) with a short but assertive email saying something like;
'Hi - just on the verge of signing something incredibly lucrative, but I need to complete a small contract first to show good faith. I need you to transfer £25,000 in to this account asap. Don't mess about with this one and email me as soon as you have done it’
The email appears to be legitimate and uses the CEO’s name, but appears to come from an email provider the CFO has never heard of. Clearly there are a number of variables, however, once again, this is a numbers game. Between Companies House and the company website there is usually enough information to have a stab at who is their CFO. However, a simple call to ‘Abigail’ can often fill in any gaps and establish some trust and corroboration of the new email address.
In the past I have pretended to be a friend from ‘the club’ and just trying to find out if there is any change to the CEO’s itinerary as I’m having difficulty getting in touch. At this point I often drop into the conversation that the only email I have had from him comes from some ‘in-country’ email provider and was delayed by 24 hours. This is often sufficient to give Abigail and the CFO all the comfort he needs to make the payment as directed.
This is not an area I have focussed on in the past, however, it can provide some immediate and lucrative ‘quick-wins’. Some of the guys who use this scam a lot, cover their tracks incredibly well. The email will ordinarily be sent via a mobile phone (burner with a Pay-As-You-Go SIM card) when connected to a publicly available website such as a library or shopping mall. However, the true origin may be being masked by means of a Virtual Private Network (VPN). Email providers can be from absolutely anywhere, but for whatever reason, South Korea seems to be a favourite at the minute.
Alternatively, the CEO’s details can be compromised during their business trip. As soon as they hand over their card the details can be captured by a skimming device or even by just sending a photograph of both sides (you really don't need hi-tech to win at this!) and passed on to an accomplice. This is a global thing so there is no need whatsoever from the fraudster to be anywhere near the victim.
As stated earlier, the personality of the ‘typical CEO’ assists the fraudster enormously. If they were more modest on social media and less willing to broadcast everything to the rest of the world, both them and their business would be a great deal safer!