Police warning local businesses of email scam

Waterloo Regional Police are asking local businesses to be extra cautious if they receive emailsasking for money transfers.

Within the past month, police have received three reports of local businesses being targets of business email compromise scams, in whichscammersget business executives to wire money to overseas accounts.

"One [business] unfortunately transferred some funds to the unknown suspect," said John Costa, a detective with the WRP fraud branch. "It was about $140,000."

In anothercase, thescammerposed as a senior executive and asked someone in the accounting department to be part of a "secret project" which they couldn't tell anyone about, and requested the money to be transferred as soon as possible.

• Traffic violationemaila scam, police warn
• Police warn about Immigration Canada phone scam
• Don't fall for Canada Revenue Agency scam calls oremails, warn police

During BECscams, the scammer will send an email to the business' finance or accounting department requesting a money transfer, typically using an address that is similar to the target's domain name.

Rather than the transfer being a legitimate business expense, the money is transferred to an overseas account.

"It looks like it's email communication between senior executives within the company," said Costa

Police warn that these scammers get to know the businesstheyare targeting and use language and information that is specific to that company,asking for a transfer ofdollar amounts that do not appear out of the ordinary.

Difficult to track

Costa explains that when the finance department gets the email, they may not realize the address being used has been slightly changed, and assume that the string of emails isactually coming from the executives.

"It's basically a Word document that is typed out to look like an email string and the email address on it, although it's a genuine email address, is not going to anyone," he said.

Costa adds tracking these kinds of scams take time because it'sdifficult to isolate and connect the scammer to theIP address being used to send the emails. However, this cycle of scams does follow a pattern, which helps police in identify them.

Police have also started a social media campaign to help local businesses from becoming victims of BEC scams and ask businesses to double check before doing any transaction.