A high-level overview of the growing problem of BEC (business email compromise) fraud and the money laundering mechanism behind it, followed by practical prevention advices that FIs and firms alike can implement right away.

1. Practical Defences Against A New Type of
Professional Bank Fraudsters
Copyright © 2016 Albert Hui

2. Who Am I
• Spoke at Black Hat, ACFE (Association of Certified
Fraud Examiner) Asia Pacific Fraud Conference,
HTCIA (High Tech Crime Investigation Association)
Asia Pacific Forensics Conference, and Economist
Corporate Network.
• Risk Consultant for Banks, Government and Critical
Infrastructures.
• SANS GIAC Advisory Board Member.
• Co-designed the first Computer Forensics curriculum
for Hong Kong Police Force.
• Former HKUST Computer Science lecturer.
Albert Hui GREM, GCFA, GCFE, GNFA, GCIA, GCIH, GXPN, GPEN, GAWN,
GSNA, GSEC, CISA, CISM, CRISC
Global Security Architect
Copyright © 2016 Albert Hui 2

3. Implications to FIs
Financial LossesLawsuit from
Customers
(breaching
Duty of Care)
AML & CTF
Implications
Criminal Liability
(handling
Proceeds of Crime)
3Copyright © 2016 Albert Hui

4. CEO Fraud or BEC(Business Email
Compromise)
Goals
• Primarily to scam victims into wiring money out
• Some scam victims to give out identity information
Natures
• Targeted Attack
• Spear Phishing → Whaling Attack
• Social Engineering Attack
Mechanism
• MITE (Man-in-the-Email) Attack
4Copyright © 2016 Albert Hui

5. High-Profile CEO Fraud Cases
5Copyright © 2016 Albert Hui

6. Significant and Growing
Up to 2015
Source: FBI IC3 Alert
Up to 2016 Feb
6Copyright © 2016 Albert Hui

7. BankStaff
How does it work?
(The Spoofing Variant)
From: CEO@<the real domain>
Reply-To: CEO@<a typo-domain>
Hacker
CEO
Wire Transfer
7Copyright © 2016 Albert Hui

8. Staff
How does it work?
(The Hacking Variant)
CEOHacker
Bank Wire Transfer
No spoofing, no typo-domain
Very realistic: Modified from previous emails, bear correct signature
8Copyright © 2016 Albert Hui

9. Commonly Posing As…
CEO or other
senior exec
Foreign
Suppliers
AttorneyBank / FI
Customers
9Copyright © 2016 Albert Hui

10. Victims
Banks / FIs Large EnterprisesSmall
Companies
10Copyright © 2016 Albert Hui

11. Why So Effective?
By Nature
• Delayed detection
• Efficient underground money laundering mechanisms
Defeat Cybersecurity Controls
• No malicious payload or links to detect
• Bypass dual-custody
• Bypass 2FA
Defeat Procedural Controls
• Bypass bank call-back
11Copyright © 2016 Albert Hui

12. Cyber Security and Fraud
People
TechnologyProcess
12Copyright © 2016 Albert Hui

13. How Can FIs Be Affected?
Financial LossesLawsuit from
Customers
(breaching
Duty of Care)
AML & CTF
Implications
Criminal Liability
(handling
Proceeds of Crime)
13Copyright © 2016 Albert Hui

14. Money Laundering
1. Via Cyprus, Latvia, Hungary, Estonia, Lithuania, Slovakia…
2. …primarily via Hong Kong and China
3. Traditional placement-layering-integration via money mules
4. Flying Money money laundering network…
14Copyright © 2016 Albert Hui

15. 飛錢 (Flying Money / Fei Qian)
1. Invented in the Tang Dynasty (618-907 AD) in Medieval China
2. Inspired the Hawala (Arabic: ‫والة‬ ِ‫,ح‬ meaning “transfer”)
alternate remittance system
3. A core part of underground banking system
4. Essentially: Value transfer without moving money…
15Copyright © 2016 Albert Hui

16. The Workings of 飛錢
• Funds balance out in agents’ books,
therefore no real money movement
16Copyright © 2016 Albert Hui

17. The Agents of 飛錢
• Many are Chinese immigrants
• Connected via family ties and Guanxi
• Many run their own businesses
17Copyright © 2016 Albert Hui

18. Preventive Measures
Awareness
Training
Verification
Protocol
Response
Plan
How to handle victim?
Who to call, what parties to notify?
What forms to fill in?
AML? Compliance? Legal? PR?
etc. etc.
Check for typo-domain
Check for spoofed email
New payment account
due diligence
(tech controls can help)
More… (see next slide)
Cyber Security
Defences
Management
Buy-In
18Copyright © 2016 Albert Hui

19. Verification Rule-of-Thumbs
+ +
1. Use out-of-band verification mechanisms
2. Do not trust incoming calls or SMS messages
3. Do not authenticate yourself before the counterparty identity is verified
(or contact information comes from trusted source)
e.g. or
e.g.
1234-5678 Look up phone number on trusted site☜
19Copyright © 2016 Albert Hui

20. How Can FIs Help?
1. Improve threat model to address heightened
CEO fraud schemes.
2. Don’t place undue trust on verified client reps.
3. Strengthen controls surrounding new payees.
4. Client security awareness campaigns.
Bank-Firm-LE
Collaboration
20Copyright © 2016 Albert Hui

21. One Last Thing
21
For the purpose of one-time PIN code,
Are SMS messages secure enough?
Are mobile app messengers secure enough?
Are messengers with end-to-end encryptions secure enough?
Copyright © 2016 Albert Hui

22. The Phone Network Itself
is Insecure
22Copyright © 2016 Albert Hui

23. What actually is this
SS7 Protocol anyway?
23
Messengers
Instant Messengers
Data
SMS
Phone Calls
SS7
End-to-End
Encrypted
Copyright © 2016 Albert Hui

24. Can’t Stress Enough…
24
Risk
Intelligence
知己知彼. 百戰不殆
Copyright © 2016 Albert Hui

25. Thank you!
Copyright © 2016 Albert Hui
25