New employees are often eager to learn and help with any task given to them. But imagine this new employee gets an email from the alleged CEO, asking for help with a project. Most won’t flinch at the chance and will jump to do as asked, but this very setup is already costing businesses over half a billion dollars.

Phishing scams have been around for years and malicious emails haven’t changed a lot, but the end target is new. As surfers and skiers say, “go big or go home,” and that’s exactly what scammers are doing. By targeting lower-level employees, scammers are gaining access to a business’s inner workings.

The Better Business Bureau has been hearing about this scam hitting businesses not only here in Idaho but across the West. The CEO impersonation scam has the con artist reaching out to employees who can pay a large bill or provide wide-sweeping information. The scammer pretends to be the CEO or chief financial officer to give the request legitimacy and urgency. The request will often be for a large money transfer via wire, or gift card purchases that are non-recoverable. Scammers often make their requests more plausible using details they’ve dug up by researching the company or hacking.

Unfortunately, because the targeted employees are new, they often don’t hesitate to complete the task, either leaking important information or spending big dollars on gift cards that are sent to a fake address.

In fact, the FBI reported that there were more than 300,000 cases of cybercrime in 2017, totaling over $1.42 billion in losses. Business email compromise scams accounted for nearly half those loses at $676 million.

These scams saw a 137 percent increase in an 18-month period, and a report by WeLiveSecurity stated that social engineering scams like business email compromise scams and phishing emails were the third most commonly reported scam last year.

With these stats and information, it is important to train employees and set up protocols to protect a business and its finances. Here are some tips BBB suggests going over with all employees.

• Be wary of short, generic messages. Scammers won’t write a long email; they’ll try to pass off something short and generic as harmless, hoping the worker clicks quickly without thinking.
• Set up policy and procedures for how employees share business information. For example, never send sensitive, personal or proprietary information via email regardless of who’s asking for it.
• Watch out for emails to groups. Sending an email “from the CEO” to a staff or employee email list is the fastest way for a scammer to attack and affect an entire business.
• Set up processes. Make sure your company has a process for all requests seeking sensitive information or payments. For particularly wide-reaching requests or large payments, require employees to check with their manager first.

If you get a call or email from a scammer, report it to BBB Scam Tracker. This free resource provides a place to research and submit scam-related information, so BBB can investigate further and educate consumers.

Jeremy Johnson is the Eastern Idaho Marketplace Manager for the Better Business Bureau Northwest + Pacific.