In response to the COVID-19 outbreak, several U.S. government entities have released warnings about a rise in scams and fraudulent activity connected to the outbreak.  In a recent bulletin, the FBI warned of a rise in phishing emails, counterfeit treatments or equipment for COVID-19 preparedness, and fake emails from the Centers for Disease Control and Prevention (CDC) purporting to provide information about the outbreak.  The FTC, meanwhile, has released not only a general overview of the steps that it is taking to combat scams related to COVID-19, but has also provided a specific list of seven types of COVID-19 scams that it has observed targeting businesses.  More information about these scams, and guidance from the FBI and FTC on how to protect against and respond to some of the most common risks, is below.

Recent Trends in Cybersecurity Scams and Threats

The FTC’s list of seven COVID-19 scams targeting businesses includes the following scams:

• “Public health” scams, where attackers send messages from the CDC, World Health Organization (“WHO”), or other public health organizations seeking information such as Social Security numbers or tax identification numbers, or asking recipients to click on a link or download a document.
• Government check scams, where attackers claim that the recipient can receive money from a government agency by making an up-front payment or providing personal information. (Note that the FTC previously provided separate guidance on identifying and combating such scams.)
• Business email compromise (“BEC”) attacks, where the attacker spoofs an employee’s or organization’s email address and directs recipients to wire money, transfer funds, or provide personal information.  The FTC cautions that in the midst of COVID-19 adjustments to working patterns, including shifts to teleworking, emergency requests may not seem unusual, and employees may no longer have access to the same options to verify the authenticity of a message (such as walking down the hall to verify with the purported sender by discussing the message face-to-face).
• IT scams, where the attacker pretends to be a member of the organization’s IT staff and requests a user’s password information or asks them to download software.  As with BEC attacks, the FTC warns that the recent shifts in work patterns could make employees particularly vulnerable to these scams.
• Supply scams, where scammers set up websites that mimic the appearance of well-known retailers and take payments without providing any supplies in return.
• Robocall scams, where fraudsters call to pitch fake COVID-19 test kits, sanitation supplies, or other related products for businesses and individuals.
• Data scams, a category that the FTC uses to describe a broad variety of potential vulnerabilities associated with the shift to teleworking that may increase the risk of data compromise.

This rise in cyber threats comes in the wake of another record year for internet crimes generally.  A recently-released report by the FBI’s Internet Crime Complain Center (“IC3”) reported that IC3 received 467,361 complaints during 2019, associated with over $3.5 billion in losses.  Notably, the most prevalent scams reported via IC3 during 2019 included not only BEC attacks and “tech support fraud” (similar to the “IT scams” referenced by the FTC’s guidance), but also a continued high number of reported ransomware attacks.  Despite only 23,775 reported BEC attacks, these attacks accounted for over $1.7 billion, almost half of the total losses reported in 2019.  However, the IC3 report noted that the FBI’s Recovery Asset Team (“RAT”), established in 2018 to streamline communication with financial institutions and assist FBI field offices in recovering funds transferred by victims to domestic accounts under fraudulent pretenses (such as BEC attacks), recovered 79% of over $384 million in losses reported to the RAT over more than 1,300 incidents.

The FBI also noted that it had observed a particular increase in the number of BEC complaints related to the diversion of payroll funds, where an HR or payroll employee receives a fraudulent email purportedly from an employee requesting to update the employee’s direct deposit information.  However, the updated information routes to an account controlled by the attacker, often linked to a pre-paid payment card account.

Guidance on Protection from COVID-19 Scams

Both the FBI and FTC alerts also provide guidance on how companies can protect themselves against the risks posed by these scams and respond appropriately should one of them occur.  The guidance includes the following recommendations:

• Sharing information on common COVID-19 scams with employees.
• Educating employees to avoid clicking on links or downloading attachments from email messages, especially from a sender that the employee does not recognize.
• Verifying the accuracy of email addresses (especially when checking email on a cell phone), and verifying requested payment changes with the intended recipient.
• Instructing employees to refrain from providing sensitive personal information, such as username/password combinations, Social Security numbers, or financial information, in response to an email or phone call.
• Providing a central point of contact where employees can verify the authenticity of messages that they receive, including BEC and IT scam messages that purport to be authentic communications from other employees.
• Typing URLs instead of relying on hyperlinks, and checking for misspellings or incorrect domains in links (e.g., using “.com” instead of “.gov”).
• Vetting unfamiliar suppliers or third parties with colleagues or other trusted sources.
• Following recent guidance on secure teleworking issued by the FTC and NIST, which Covington has covered in a separate blog post.
• Continuing to monitor government websites, including the FTC and IC3 websites, for updates on trends in cyber threats that may target specific populations.

Both the FTC and FBI guidance recommend reporting attacks and scams using the designated reporting mechanisms provided by the FTC and IC3.  If an organization has fallen victim to a BEC attack, the IC3 report also recommends that the organization contact the originating financial institution as soon as fraud is recognized to request a recall or reversal as well as a hold harmless letter or letter of indemnity.