2024 Training Schedule Available

El Paso Loses 3.2 Million Dollars via Spear Phish

Share This Post

In 2016, phishing reached an all-time high by the second quarter. An average of 155,000 phishing emails were sent out during the months of April, May, and June according to the Anti-Phishing Workgroup. This alarming trend was noted among many industry analysts, helped to bring much of information security to the forefront of news media, and generated more visibility into the security community as an increase in the cost and visibility of these attacks made them a threat to many businesses.

In August of 2016, the city of El Paso, Texas was scammed out of a total of $3.2 million USD. How did this happen? By a simple e-mail. Starting in August, the Camino Real Regional Mobility Authority (CRRMA) was contacted by an entity claiming to be a contractor for the city’s new streetcar project.  These attackers were able to learn the identity of both the person in charge of the CRRMA and an actual contractor being used by the city in construction efforts and were successful in targeting the executive in charge of the project by impersonating this group. The group claimed to be using a joint venture organization as the subcontractor on the deal and requested a different bank account for the payment of the contract. When the new banking information was given by the attackers, several questions were raised by the city comptrollers. They requested the required forms and documentation to complete the transaction, and the CRRMA executive helped the attackers know what they needed to file and how to get the documents, which are still suspect and under investigation as to whether they are forged or not. 

After being contacted by the real vendor stating there had been no payment made, an investigation was launched and the payments were put in recovery in conjunction with Wells Fargo. The city has so far recovered $1.9 million USD and is actively working to manage the issue and on policies and procedures on what to do in the future to prevent this.

Options to combat this type of attack are varied, but in this case, the attacker contacted the target with the claim of being the vendor and was not vetted by following up with a known contact at the vendor company. In doing this, the target could have noticed several issues and prompted a review of the request at a much earlier stage. Frequently accompanying the impersonation of a company or individual there is a letter off in the name of the domain, or the company name, a technique known as typo-squatting. Looking for these inconsistencies can also help in deterring this type of attack. 

Frequently, a little paranoia can stop an attack before it happens.  

  

More To Explore

Smishing attacks in the news
SMiShing

SMiShing Attacks in the News 

SMiShing Attacks in the News In February 2024, 19.2 billion spam texts bombarded U.S citizens according to a recent report. As annoying as spam texts are, they are not always

Discover Your Vulnerabilities before Hackers Do!
Security Assessment

Discover Your Vulnerabilities before Hackers Do! 

Discover Your Vulnerabilities Before Hackers Do! In this fast-paced world, staying ahead of hackers and attackers is vital. Our personal and company’s security are more important than ever. For this