FinCEN Report Increased Number of SARs for Business Email Scams

FinCEN has released a Financial Trend Analysis showing that the number of suspicious activity reports (SARs) recounting incidents of business email compromises (BECs) increased significantly from 2016 to 2018.  A BEC is a type of email scam in which scammers target businesses and solicit fund transfers through a variety of methods such as impersonating a CEO or vendor and requesting payment for what appears to be normal business activity.

According to FinCEN, the total number of BECs grew from an average of 500 per month in 2016 to over 1,100 per month in 2018, and the total value of thefts attempted via BECs increased from $110 million per month in 2016 to $301 million per month in 2018.

FinCEN evaluated “randomly selected, statistically representative samples of SAR narratives on BEC incidents filed in 2017 and 2018” and found the following:

• Real estate firms accounted for 16% of all reported incidents in 2018, up from 9% in 2017.
• The share of BEC incidents from the financial services industry decreased from 16% in 2017 to 9% in 2018.
• Most BECs in 2017 (73%) involved domestic transfers, likely designed to appear as an ordinary business transfer and avoid arousing the suspicion of the transferor.
• The most widely-used method of conducting BECs in 2018 was sending fraudulent vendor or client invoices; this method accounted for 39% of all BEC incidents last year. The most frequently-implemented method in 2017 was the impersonation of CEOs and CFOs; FinCEN attributes the shift to greater awareness of BEC schemes and potential for greater financial gain in certain industries.

The report also discusses FinCEN’s Rapid Response Program, which has tracked and recovered more than $500 million of stolen funds since 2014.