Six gift cards and a forged executive

An employee at a courier company received mail that appeared to come from an executive. The instruction was confidential. Buy six $500 MasterCard prepaid cards as staff gifts, photograph both sides, and send the photos as proof. She paid with her own card at a post office and emailed the images. When she handed the physical cards to the real executive, he had never asked for them. Every message had come from an unrelated address.

There was no malware on her PC. This was CEO fraud, a form of business email compromise that uses urgency and hierarchy. The missing control sat in the payment process, not in an appliance: call the named executive on a number the firm already trusts, and treat photographs of card numbers as a warning, not a workflow.

Why the message worked

A scam is a message that pretends to come from a person or firm you already trust. Display names are easy to forge. A lookalike domain is cheap. The check that works is boring: if a message from a known entity feels off, contact that person or firm through details you already hold or that you found on their official site. Do not use the number or the link inside the suspicious mail.

Sources

• ACSC Small Business Cyber Security Guide (June 2023).

Related: The ACSC small business guide, as one account · Business pathway.