Combating New Opportunities for Corporate Fraud During COVID-19 Outbreak

As the term “social distancing” has burst into our daily vocabulary, we are in a new territory of conducting daily business through remote working situations. While this taught us new lessons in creative adaptation, it has also created fresh opportunities for corporate fraud. Protecting yourself, your company, and your employees from these new fraud threats during the COVID-19 outbreak is essential.

Business Email Compromise Attacks

On March 3, 2020, the FBI issued a Private Industry Notification warning companies that fraudsters were abusing the Microsoft Office 365 and Google G Suite platforms as part of widespread Business Email Compromise (BEC) attacks. The rapid and extensive shift to a remote-based workforce has created a prime opportunity for BEC and other social engineering attacks. In these types of schemes, fraudsters pose as someone from within the victim’s company and request sensitive business or personal information.

For example, a fake HR Director may contact an employee instructing them to forward employee W-2s. While the request may be unusual, today’s circumstances are far from ordinary. It is entirely plausible that your company’s HR Director, who does not have access to information located in your now closed, requests the information directly. Because they hide behind a mask of legitimacy, these fraudulent requests have high rates of success.

To combat BEC and Social Engineering attacks:

• Be wary of unusual requests and confirm the source of the request through a different media than the request was received. For instance, if the request was received via email, confirm the request through a phone call, SMS, or direct message.
• Never transfer personal data or sensitive business information to someone you don’t know, even if they appear to be from within your organization.
• Be sure an appropriate protocol is in place for transferring sensitive information outside your organization, that your employees are aware of the protocol, and that it is consistently followed.

Employee Fraud

Unfortunately, fraud doesn’t exclusively emerge from the outside of an organization. When management and other key departments are busy navigating a pandemic, things like internal controls and anti-fraud efforts often take a back seat. While understandable, these refocused priorities make the organization increasingly vulnerable to attacks from within. When the perception of possible detection decreases within an organization, some employees may be tempted to take advantage when the normal watchdogs are visibly distracted and/or very likely overwhelmed. Remember the fraud triangle: pressure, opportunity and rationalization all tend to increase dramatically in times of uncertainty and unrest.

To combat attacks from within:

• Be sure your organization’s internal controls, policies and procedures are being followed and even enhanced during times of distress.
• Elevate potential fraudsters’ perception of possible detection by communicating to everyone within the organization that management is being more vigilant in remote-working situations.

COVID-19 and our efforts to fight infection through remote-working arrangements will be a reality for the foreseeable future. With fraudsters working overtime to develop new ways to take advantage of this crisis, we must remain informed and vigilant in our anti-fraud efforts.

While we may not always control what is happening around us, we can—and in fact we must—manage our reactions to it. As always, the team at GLEASON is here to help you manage the fraud risks that your organization may face today and every day. We will get through this together.

For more information about GLEASON’s forensic accounting and fraud mitigation/detection experience and expertise, please visit read more here.

Matt Gleason April 14th, 2020

Posted In: Gleason Experts

Leave a Comment

Remote Data Attacks—Heightened Awareness During COVID-19 Outbreak

Disasters have a tendency to bring out the best and worst in people. Sadly, serial fraudsters view events such as the COVID-19 pandemic as the perfect opportunity to strike. They are keenly aware that potential victims and typical watchdogs are likely distracted, stressed and overwhelmed. Unfortunately, fraudsters are well experienced in using fear and panic to their advantage.

To protect yourself, your employees, and your customers during these difficult times, be aware of the following scams which, unfortunately, are currently on the rise.

Phishing/SMiShing

In Phising/SMiShing schemes, fraudsters use emails and text messages that induce a victim to reveal sensitive personal information such as financial data, email credentials, passwords, etc.

A tried and true method used by would-be fraudsters is to make messages appear to be from legitimate sources. During the COVID-19 pandemic, beware of messages that appear to originate from the Centers for Disease Control, World Health Organization or local health department. Fraudulent messages will exploit a victim’s fear and/or desire for information by including links stating “For the safety measures you need to know, click here,” “Clicking here could save your life,” or “Click here to read the latest on COVID-19.” Others pose as shipping companies and send seemingly inconspicuous messages such as “Click here to update your delivery preferences to protect yourself against COVID-19.”

These links may direct a victim to a legitimate looking site, where they are prompted to enter an email address and password. Should a victim enter the information, they may unwittingly provide a fraudster with full access to the victim’s email account, as well as any other accounts for which the victim uses the identical email and password combination.

Other Phishing/SMiShing scams in the age of COVID-19 offer “free” testing kids and services or related products, claiming the victim need “only pay shipping and handling.” Once the unassuming victim enters their credit card information, the fraudster may use the information for unauthorized purchases. The testing products either never arrive, or if they do, they do not work. In such cases, not only has the fraudster stolen the victim’s identity, but the victim may also have relied on the results of a bogus medical test.

Blackmail Scams

In a COVID-19 blackmail scam, fraudsters prey upon business-owners’ fears that an outbreak at the business’s location could have disastrous effects on sales. The fraudster may contact the would-be victim claiming to be an individual who has contracted COVID-19 at the victim’s business. The fraudster then demands payment in exchange for their silence. The payments are to be sent to overseas accounts which are virtually untraceable.

Malware Attacks

Malware attacks use malicious software to damage devices, steal data and/or gain unauthorized access. Examples include ransomware, keyloggers and spyware.

Malicious links and attachments can trigger a download of malware onto your computer or device. In such attacks, again the fraudster preys on the victim’s desire for information during crisis.

One example of malware recently discovered uses a supposed “real-time Coronavirus map originally developed by Johns Hopkins” as its bait. A fraudulent “Coronavirus Tracker” app is also in circulation. Victims, intending to obtain useful information such as the real-time location of positive tests, click to open the attachments and unwittingly install malware programs on their devices. Such malware programs may be used by fraudsters to gain access to company networks—especially during a time when many employees are accessing their employers’ networks remotely—or may be used to appropriate email programs and passwords stored on the device. Other malware programs may lock a user out of the device, and demand a ransom payment to unlock the user’s data.

Combatting Remote Data Attacks

To combat Phishing/SMiShing, blackmail and malware attacks:

• Don’t act on impulse or out of panic.
• Be wary of unsolicited emails and text messages that request your personal information.
• Do NOT click links, open attachments or download files from unknown or unverified sources.
• Make sure your device’s operating system, anti-virus software, and anti-malware software are operational and up to date.
• Be wary of any Coronavirus related messages or apps, even those that appear to be from legitimate sources.

The team at GLEASON has numerous trained Certified Fraud Examiners and forensic accounting professionals who stand ready to help you manage the fraud risks that you and your organization face today and every day. We will get through this together.

Matt Gleason April 14th, 2020

Posted In: Gleason Experts

Leave a Comment

COVID-19, Economic Slowdown and the impact on Valuation

As uncertainty surrounding the timeline and ability to manage the spread of COVID-19 grows, so does the complexity of managing and valuing businesses.  Social distancing and the reduction or elimination of “non-essential” activity has profoundly disrupted or even closed businesses and supply chains across the United States and globe.  There are a number of environmental factors that business owners, their counsel and advisors should be aware of that may affect the value of a privately held business.  We’ve summarized some, but not all, of the key issues to consider below:

• Valuation Date – Depending on the objective of the analysis, the date of the valuation may drive the extent to which the COVID-19 pandemic can be considered.
  • Valuations performed under most income tax and financial reporting standards require valuations to consider only facts and circumstances “known or knowable” as of the valuation date.
  • Valuations performed as of a specific date in early 2020 are complex given the “known or knowable” standard combined with a constantly changing news cycle and varying public expectations surrounding containment of COVID-19.

• Use of Historical Financial Results and Management Projections – For many companies, historical financial results from before March 2020 are suddenly less relevant to a valuation of the business during this period. Conversely, preparing projections of future results during this unprecedented period of uncertainty is a challenging exercise.  Gleason’s valuation processes includes asking informed, directed questions and considering in-depth valuation issues specific to each business. For example:
  • Is the disruption to customer behavior, supply chains or working capital so severe that historical financial results are irrelevant?
  • When do management, investors and analysts believe the company and its industry’s operations will resume normalcy, and, to what extent will the “new normal” level of operations compare to historical results?
  • Given existing working capital, how long can a company survive and what changes can be made to its cost structure to extend the survival timeline? To what extent does the business have access to short-term funding, including government assistance?
  • Have short-term sales been lost, delayed or some combination thereof? Can the company expect a mid-term spike in revenue when economic activity returns?
  • What is the lead time between customer orders/demand and the delivery of goods or services? How will a delay in demand effect revenue (positively or negatively) six months, one year or two years down the road?
  • What capital spending, research and development and other growth projects must be or can be delayed or cancelled and what effect does this have on the company’s long-term growth rates?
  • What is the company’s position within its industry? Is it better or less equipped to handle this upheaval than its competitors?  Who will be in the market in the future? Will the behavior of customers permanently change in a way that impacts both the company and the industry?
  • How effectively and productively can employees work remotely?

The answers to these key questions and issues will vary on company by company basis.  Gleason relies on its experience and expertise to assess responses to these issues and quantify the effect on the value of each specific business.

• Cost of Capital – In general, increased uncertainty results in increased cost of capital (i.e. required rate of return) and, consequently, lower values. Indeed, securities analysts and academics have recently advocated an increase in the cost of capital associated with all publicly traded companies relative to the risk-free rate (this is commonly referred to as the Equity Risk Premium, or “ERP”). The following are business-specific issues that valuation analysts will need to consider to determine a cost of capital for specific companies:
  • Is management prepared to effectively guide the business through the issues it faces?
  • Is the company able to provide reasonable, reliable projections?
  • How has volatility in public markets affected business and industry-specific risk?
  • Has the company’s cost of borrowing changed? Does the business have capacity on its current debt facilities?

Gleason’s experience and expertise in assessing and analyzing cost of capital issues provide us with the tools required to consider these issues specific to each business and determine a reasonable, reliable measure of a required rate of return specific to the subject company in every valuation.

• Use of Market Multiples – Careful consideration must be given to the calculation and application of valuation multiples derived from historical (normal) market transactions or public markets. Key considerations for valuation analysts include:
  • When applying the market approach in times of uncertainty and market turmoil, it is essential to appropriately match market multiples with subject company results. For example, it is important not to mix and match implied forward valuation multiples and historical financial results for a subject company.
  • Depending on specific comparisons of the subject company and the guideline public companies, it may be more appropriate to rely on trailing valuation multiples than forward looking multiples. The valuation analyst will need to understand the extent to which the subject company has reliably revised projections relative to the guideline companies.

COVID19 has increased the complexity of valuations of practically all businesses.  Over the past 30 years, Gleason guided clients has assisted its clients in the past through times of extreme volatility, uncertainty, and complexity and is ready to assist you today.  Please reach out to one our team members for customized answers to the above questions as they specifically pertain to your business.

Matt Gleason April 8th, 2020

Posted In: Gleason Experts

Leave a Comment