Real Claims: The Most Common Cyber Claims
The most common cyber claims seen by CLIA are due to Business Email Compromise, also known as BEC.
Business Email Compromise events can take many forms:
Fake invoice fraud: An attacker impersonates a vendor or contractor and sends an invoice asking for payment to a new bank account.
Impersonation: An email appears to come from someone within the firm, often with seniority, that pressures staff to make a confidential transfer or share sensitive documents.
Account takeover: An attacker gains access to a real employee’s inbox and uses it to send legitimate-looking payment requests.
Payroll diversion: An attacker changes direct-deposit details by pretending to be an employee or HR contact.
Data theft request: The attacker uses email to ask for business records, client records, or banking details.
Real estate or closing fraud: A spoofed email changes wire instructions during a property sale or major transaction.
Real Incidents Seen by CLIA:
A law firm partner’s email was hacked by an attacker, and emails under the partner’s name were being sent out with malicious attachments.
A client received an email from what appeared to be their lawyer. However, the email was from an attacker impersonating the client’s lawyer. The email told the client they owed money, and the attacker was attempting to have the client transfer them funds.
A lawyer’s email was hacked. The hacker began emailing clients with fake wire instructions, resulting in a significant loss for at least one of the clients.
These incidents are increasingly common, and fraudsters are becoming increasingly sophisticated. It is important to stay vigilant and mindful to anything that appears unusual, and to ensure you and your staff are educated on cyber threats. It may also be prudent to have a discussion with your clients about communications they can expect from you, and red flags for clients to look out for, to ensure they are not duped by a fraudster.
Want to learn more about CLIA’s cyber coverage and claims reporting? Check out our previous blog post: Roundup – Cyber Coverage and Reporting Cyber Claims