Dutch organisations address business email compromise fraud

The FBI’s Internet Crime Complaint Center received nearly 24,000 reports of business email compromise (BEC) fraud last year, involving sums totalling more than $1.7bn worldwide. To tackle this highly damaging form of cyber crime – and other types of attack – in the Netherlands, the Dutch Public Prosecutor’s Office and the Hague Security Delta Office are working in a public-private partnership with banks, companies, governments and knowledge institutes.

The best-known case of BEC fraud – also known as CEO fraud – in the Netherlands concerned cinema chain Pathé. In 2018, criminals posed as directors at the company’s French head office and sent emails to its Dutch management requesting money to pay for a takeover abroad. The Dutch management received an urgent request not to tell anyone about the transactions in order to take the wind out of competitors’ sails.

Although Pathé’s Dutch management had their doubts about the request, they cooperated. After the first transaction, the fraudsters started asking for ever larger amounts and a total of €19.2m was taken. It was only when the Dutch management knocked on the door of their French parent company to explain there was too little money to transfer, that the CEO fraud became apparent.

The Netherlands’ public-private partnership to tackle BEC fraud aims to map out how cyber criminals work to disrupt their business model and increase the chance of identifying the cyber criminals. Lodewijk van Zwieten, prosecutor of cyber crime at the Public Prosecutor’s Office, said: “We are working with various partners to gain insight into the processes and modus operandi of cyber criminals. After all, the old-fashioned search for criminals does not always work effectively in the digital world.

“By gaining insight into the digital criminal business model, we can tackle the phenomenon. We have chosen to start with the cyber crime method that causes the most damage worldwide – BEC.”

Although the FBI has reported global losses of $1.7bn resulting from BEC, actual losses are likely to be higher. Many companies do not report such attacks, which is why no reliable figures are available for the Netherlands.

“There is only limited reporting and the figures that are available say very little,” said Van Zwieten. “But that is no reason to doubt the figures from the FBI and various security companies. We want to invest as much as possible to combat this cyber crime.”

Once the cyber criminals’ business model has been revealed, it is important to disrupt the processes effectively, said Van Zwieten. “The use of criminal law is not always effective or desirable in tackling this type of crime,” he said. “But when such a criminal has a business model with dependencies – in the ordinary world, we call that a supply chain – then an approach can focus on that supply chain.

“We see that hardened criminals hide themselves very well, which makes it difficult to catch them, but if we disrupt their business model by focusing on the facilitating organisations, we have a better chance of getting close to them.”

“What we are mapping out is the complete process that an average BEC criminal follows, from the moment he or she gets an idea, to the moment they put the money in their back pocket. We really put ourselves in the criminal’s shoes and try to figure out what steps they have to go through and who and what they need.

“This way, you find out that criminals also need external expertise. They can get it from an above-ground market, such as hosting, or from an underground market, such as knowledge about money laundering. We map out this value chain within the partnership.”

The group is currently developing a number of interventions to make it more difficult for cyber criminals to carry out their work. “By this, we mean interventions that make potential victims more resilient,” said Van Zwieten. “For example, we are also working with banks to see how we can trace fraudulent transactions sooner.”

Van Zwieten gave the example of a digital invoice, on which the account number is changed by a criminal. When a bank sees such a transaction, an alarm bell should go off because the account number differs from the one through which regular payments are made.

“This is how we actually try to erect all kinds of barriers for BEC criminals as quickly as possible,” he said. “Things that make the criminal’s processes not run so smoothly, so he or she stops or has to go to a lot more trouble. Criminals often don’t want the latter, because then they have to step out of the shadows, increasing the chances of being caught.”