SEC Section 21(a) Report on Nine Issuers' Business Email Compromise Losses

What happened

On October 16, 2018, the U.S. Securities and Exchange Commission issued Release No. 34-84429, a Report of Investigation under Section 21(a) of the Securities Exchange Act of 1934, describing business email compromise frauds that had struck nine unnamed public companies in the technology, machinery, real estate, energy, financial, and consumer-goods sectors. The Commission determined not to pursue enforcement actions against the issuers based on the conduct and activities known at that time. Each issuer lost at least $1 million, two lost more than $30 million, and combined losses approached $100 million, almost all of which was unrecovered. The frauds involved fake-executive schemes using spoofed executive identities and fake-vendor schemes using compromised foreign-vendor email accounts. The report explains that internal accounting controls should account for these cyber-related risks, while expressly stating that victimization by such a scam does not by itself mean an issuer violated the federal securities laws.

How it worked

Fake-executive variant: attackers spoofed the email domain or address of a company executive, typically the CEO, and emailed finance personnel with time-sensitive instructions to wire funds. The messages directed personnel to coordinate with a purported outside attorney using real law-firm and attorney names, who supplied instructions for foreign accounts controlled by the perpetrators. The messages emphasized secrecy and sometimes contained spelling or grammatical errors or false references to government oversight. Fake-vendor variant: perpetrators compromised foreign vendors' email accounts, inserted illegitimate payment requests into communications concerning otherwise legitimate transactions, corresponded with issuer personnel to obtain purchase-order and invoice information, and supplied doctored invoices or fraudulent bank changes. The report found that the frauds succeeded at least in part because responsible personnel did not sufficiently understand existing controls or did not recognize signs that the electronic instructions were unreliable.

The lure and the tell

The lure: an email that looked like it came from the company's own CEO or a real, currently-corresponding vendor, wrapped in urgency and, in the fake-executive cases, secrecy from other company employees. The tell, in hindsight: out-of-domain or spoofed sender addresses that a careful header check would have caught; requests to bypass or reinterpret established dual-authorization / authorization-matrix controls; wire instructions to newly designated foreign accounts with no independent verification call placed; in some fake-executive emails, spelling/grammar errors or oddly specific but false invocations of SEC/government process; and, in fake-vendor cases, an invoice or bank-change request arriving with no advance notice inside an otherwise-legitimate thread, discoverable only when the genuine vendor separately complained about a past-due bill that had, unbeknownst to them, already been "paid" to the wrong account.

Outcome

The Commission determined not to pursue enforcement actions against the nine issuers based on the conduct and activities known to it at the time. It issued the Section 21(a) report to alert issuers and market participants that spoofed or manipulated electronic communications should be considered when devising and maintaining internal accounting controls. Almost all of the nearly $100 million lost across the nine issuers was unrecovered. The report expressly states that an issuer is not necessarily in violation of the internal-accounting-controls requirements merely because it becomes the victim of a cyber-related scam.

Why it matters

The report shows that cyber-related fraud can implicate the design and operation of internal accounting controls even when perpetrators use spoofed or compromised communications rather than intruding into an issuer's own systems. It emphasizes that controls depend on the personnel who implement and follow them, and that issuers should reassess controls as risks evolve. It also cautions that victimization alone does not establish a securities-law violation and leaves issuers to develop controls suited to their operational needs and risks.

Defenses

Practical defenses consistent with the report's findings include: (1) enforce appropriate authorization requirements for outgoing payments; (2) train responsible personnel to understand authorization policies and recognize unreliable electronic instructions; (3) independently verify vendor bank-detail changes using established contact information; (4) review unusual payment requests, including those involving secrecy, urgency, or foreign accounts; (5) strengthen account reconciliation and outgoing-payment notifications to improve detection; and (6) periodically reassess internal accounting controls against evolving cyber-related fraud risks. The report notes that the issuers enhanced payment authorization, vendor-change verification, reconciliation, notification, and training after the frauds.