The Long Tail of PPP By Jeff Otteson and Adam Dawson, Midwest Bankers Insurance Services T he Paycheck Protection Program (PPP) may have ended, but the information it generated continues to create opportunities for fraudsters. Businesses that received PPP loans are now being targeted through highly personalized bank-impersonation schemes. Using publicly available PPP loan information, criminals can identify a business, its loan amount and, in many cases, the financial institution associated with the loan. That information gives a fraudster enough credibility to make an unexpected call, text message or email sound legitimate. This is not simply another generic phishing campaign. It is a targeted social-engineering attack built around real information and a trusted banking relationship. How the Scam Works The Small Business Administration maintains a public, loan-level dataset covering disbursed PPP loans. Fraudsters can combine that data with business websites, social media and other public records to develop a convincing profile of a potential victim. A fraudster may know: • The business’s legal name and address • The amount of its PPP loan • The lender associated with the loan • The names of owners, executives or accounting employees • The bank’s treasury-management or fraud-department terminology The criminal then contacts the business while impersonating an employee of its bank. Caller ID may be spoofed so the call appears to originate from the bank’s actual telephone number. Emails and text messages may use the bank’s name, logo and branding. The purported reason for the contact can vary. The customer may be told that: • A suspicious ACH or wire transfer is pending. • Someone attempted to access the company’s online banking account. • A check or electronic payment must be verified. • The account must be frozen to prevent additional fraud. • A security update is required. • The bank needs to confirm the customer’s credentials. • A one-time passcode is needed to stop or reverse a transaction. The fraudster creates urgency and positions themself as the person trying to protect the customer. In reality, the criminal may already possess the customer’s username and password. The call is designed to obtain the final piece needed to defeat multifactor authentication: the customer’s one-time security code. The FBI has specifically warned about account-takeover schemes involving criminals impersonating financial institution support personnel. Once the customer provides the requested code, the fraudster may gain access to the account, establish a new device, change contact information or initiate unauthorized ACH and wire transfers. Why These Calls Are So Convincing Traditional fraud-awareness training often tells customers to look for spelling mistakes, unfamiliar senders or vague messages. Those warning signs may not be present here. The caller may correctly identify the customer’s bank, PPP loan and business information. The telephone number appearing on the caller ID may match the number printed on the back of the customer’s debit card or listed on the bank’s website. The criminal may even transfer the victim between several supposed departments to create the appearance of a legitimate financial institution. The use of accurate information does not make the caller legitimate. It only demonstrates that the criminal has done research. Bank customers should understand that caller ID is not a reliable authentication method. A person who receives an unexpected banking call should hang up and contact the bank through a telephone number the customer independently knows to be correct — not a number provided by the caller or contained in an unsolicited message. What Banks Should Be Telling Their Customers Banks should communicate directly with business customers, particularly customers identified in public PPP data. The message should be simple and specific: The bank will never call and ask a customer to disclose a password, authentication token or one-time security code. Customers should also be reminded that a code generated by multifactor authentication is not merely an identification number. It may authorize access, approve a new device or permit a transaction. Providing that code to another person can be the digital equivalent of handing over a key to the account. Why Bank Customers Are Being Targeted Again Colorado Banker 20
RkJQdWJsaXNoZXIy MTg3NDExNQ==