German wire supplier Leoni loses €40m in email impersonation scam

Leoni AG, a Germany-based supplier of wires, cables and wiring systems, has fallen victim to fraud with the help of falsified documents and identities and the use of electronic communication channels, the company has announced. As a result, company funds were transferred to accounts abroad.

The CFO of one of Leoni’s factories in Romania allegedly transferred €40m following an e-mail received from the headquarters in Nuremberg, Germany. A few days later, they realized they fell victim to an email impersonation scam since the money never reached the intended recipient.

“The Management Board immediately launched an investigation into the events and is currently assessing claims for damages and insurance claims,” the company said in a press release. “It has also reported the matter to the police criminal investigators. The damage amounts to an outflow of liquidity totaling around EUR 40 million. The criminal activities have not affected the IT infrastructure or data security”.

Leoni’s share price fell more than 5% to 33.3 euros after the announcement. It reached a low of 32.8 euros on Aug. 29. Leoni has a market capitalization of 1.08 billion euros.

“The extent to which the damage will affect the projected net income for the year cannot at present be assessed. The liquidity situation of the Leoni Group has not been adversely affected in any material way. The performance of Leoni’s operations is in line with the forecast,” Leoni officials said.

Total losses caused by Business Email Compromise (BEC), a sophisticated scam targeting businesses working with foreign suppliers and businesses that regularly pay by wire transfer, have grown 13-fold since January, as measured by identified exposed losses, to over $3 billion, the FBI said this summer, cited by Business Insights. The BEC scam claimed 22,143 domestic and international victims, and inflicted a combined exposed dollar loss of $3,086,250,090, which includes actual and attempted loss.

Here is a short list of FBI recommendations to avoid BEC scams:

• Avoid free web-based e-mail accounts: Establish a company domain name and use it to establish company e-mail accounts in lieu of free, web-based accounts.
• Be careful what is posted to social media and company websites, especially job duties/descriptions, hierarchal information and out of office details.
• Be suspicious of requests for secrecy or pressure to take action quickly.
• Consider additional IT and financial security procedures, including the implementation of a two-step verification process. For example -
  • Out of Band Communication: Establish other communication channels, such as telephone calls, to verify significant transactions. Arrange this second-factor authentication early in the relationship and outside the e-mail environment to avoid interception by a hacker.
  • Digital Signatures: Both entities on each side of a transaction should use digital signatures. This will not work with web-based e-mail accounts. Additionally, some countries ban or limit the use of encryption.
  • Delete Spam: Immediately report and delete unsolicited e-mail (spam) from unknown parties. DO NOT open spam e-mail, click on links in the e-mail, or open attachments. These often contain malware that will give subjects access to your computer system.
  • Forward vs. Reply: Do not use the “Reply” option to respond to business e-mails. Instead, use the “Forward” option and either type in the correct e-mail address or select it from the e-mail address book to ensure the intended recipient’s correct e-mail address is used.
  • Consider implementing Two Factor Authentication (TFA) for corporate e-mail accounts. TFA mitigates the threat of a subject gaining access to an employee’s e-mail account through a compromised password by requiring two pieces of information to login: something you know (a password) and something you have (such as a dynamic PIN or code).