Dive Brief:

• The FBI and Cybersecurity and Infrastructure Security Agency on Tuesday warned businesses to protect themselves against cybercriminals trying to fraudulently divert payments during the holiday season.
• Threat activity involving fraudulent third parties usually accelerates during the holiday season, the agencies said. Businesses need to be aware of emails from alleged vendors or retailers claiming to change their account numbers. 
• Officials urged businesses and individuals that are targeted to promptly report the incidents to IC3, which has an asset recovery unit that can help intercept fraudulent payment activity and return those payments back to the victim.

Dive Insight:

The warnings come just days before the official launch of the holiday shopping season, beginning on Thanksgiving and extending through the Black Friday weekend. Retailers, many of which started the deals early, will promote extended discounts through at least Cyber Monday. 

Companies often spend the holiday season working to reconcile any outstanding payments they are owed, and also pay organizations they owe money to at the end of the year. During this period authorities say there is a heightened threat of business email compromise attacks. 

“I think that businesses should be very leery of any changes in payment information for their vendors,” said Mary Gleason, supervisory special agent at the FBI field office in Phoenix, told Cybersecurity Dive. 

The threat from these types of attacks is not only to direct businesses, but the customers of these businesses as well, according to Jerry Keely, a cybersecurity advisor in CISA’s Region 9, which includes Arizona, California, Nevada, Hawaii and some U.S. territories.  

Gleason stressed that victims of these attacks should report them immediately. A local municipality in Arizona was targeted for $5 million, however after calling the FBI and reporting the attack at IC3.gov, asset recovery was triggered and nearly all of the funds were returned. 

Authorities also warned companies to set up multifactor authentication to prevent criminals from gaining additional access to compromised systems.