In the past week, the NJCCIC observed an uptick in threat actors impersonating multiple New Jersey organizations to redirect legitimate payments and steal funds, resulting in significant financial losses. Threat actors leverage publicly available information to identify and target potential victims in these fraudulent schemes. They send convincing phishing emails by impersonating known and trusted organizations or spoofing legitimate domains. The threat actors often create a sense of urgency for payment and include updated payment instructions. If successful, the targets send funds via wire transfer or physical check to be deposited into threat actor-controlled accounts.
In one report, threat actors spoofed a vendor’s email address in a phishing email. They emailed the target updated payment information for goods and services to be paid through a wire transfer. In another report, threat actors impersonated a vendor to send a phishing email with the subject line “Vendor Form Request” and updated payment instructions.
The target sent a physical check that was deposited by the threat actors. In a separate report, threat actors impersonated a public sector organization to send phishing emails, claiming that there is an outstanding invoice. They created a sense of urgency to request payment and provided instructions to complete a wire transfer.
Recommendations
- Exercise caution with communications from known senders, especially unsolicited communications claiming you owe money.
- Verify the source and instructions for any monetary transaction received via email by using a separate means of communication, such as a phone call or other trusted process.
- Confirm using contact information obtained from verified, official sources since email replies are not an effective verification method, as they could be sent to the threat actors.
- Navigate directly to legitimate websites and verify them before providing sensitive information or wiring funds.
- If funds are unintentionally wired or paid to a fraudulent account, immediately notify a supervisor, the banking institution, the FBI, and the US Secret Service to stop the payment. Unless the fraudulent transaction is discovered quickly (typically within 48 hours), it can be difficult, if not impossible, to return the stolen funds.