podcast

Articles

Podcasts

Videos

Find a branch or ATM

Contact our Thought Leadership team—we value your insights!

Have questions or feedback?

Manage your meeting

Need to meet?

Explore the latest insights, reports, and timely topics affecting economic growth at home and around the world.

CIBC Thought Leadership

Connect with us:

This transcript has been generated using machine learning technology. While this technology was trained with CIBC terminology, it may contain errors.
Intro: Welcome to Cash Management Chat, a podcast series focusing on the dynamic world of treasury and cash management. Tune in for expert insights and practical advice to navigate today&#8217;s financial landscape brought to you by the Corporate Cash Management Team at CIBC Capital Markets.
Andre Blanchard: Hello and welcome to this episode of CIBC Cash Management Podcast, where we explore the issues, trends and insights that matter most to businesses managing payments, cash flow and risk. I&#8217;m Andre Blanchard, and today we&#8217;re discussing an issue that continues to affect organizations of all sizes, fraud.
We&#8217;ll look at bank impersonation, business email compromise, phishing, mobile phone and computer takeovers, and how AI is changing both the fraud attempts and fraud prevention. Joining me today is Ryan Powell, Vice President of Fraud Management at CIBC. Ryan works closely with my team and other teams and clients to help identify fraud trends and strengthen awareness around emerging threats.
Ryan, welcome and thank you for joining us.
Ryan Powell, Vice President of Fraud Management, CIBC: Thanks, Andre. It&#8217;s great to be here. Fraud is an important topic and I&#8217;m glad we have the opportunity to talk about it.
Andre Blanchard: So let&#8217;s kick things off Ryan. Fraud continues to evolve, and many schemes are becoming more sophisticated as time progresses. Before we get into specific examples, how should businesses or clients think about the fraud landscape?
Ryan Powell: Yeah, I&#8217;d like to frame it in sort of two traditional fraud types. Unauthorized and authorized. Unauthorized would be situations like account takeovers, stolen credit cards. And by authorized, we would mean different types of scams where the client makes a fraudulent payment themselves. In an account takeover, a threat actor uses deception to obtain access to an account and then conduct those unauthorized transactions. In a scam, however, the threat actor deceives or coerces a client into paying someone other than who they believe they are paying, such as in a business email compromise, or deceives them into paying for something they will not receive, as can happen in an investment or extortion scam. Fraudsters are very effective at creating a sense of urgency and legitimacy. They&#8217;ll use phone calls, emails, websites and various impersonation tactics to make businesses believe they&#8217;re dealing with a trusted source.
Andre Blanchard: And Ryan, this this isn&#8217;t new to our landscape. Like, what are some real life examples of that?
Ryan Powell: You&#8217;re right. These are not new, but they do evolve with technology. And a great example of this is the so-called Nigerian print scam. Many people first encountered that by email in the 1990s, but versions of this, which we call an advanced fee scam, have actually existed for more than 100 years and started in mailed letters.
And today, with always connected apps, websites, email and messaging services, they allow the same basic deception to reach more people much faster. In many cases, the scam works not because systems fail, but because the requests appear credible in the moment. And that&#8217;s why awareness is so important. Businesses need to know what these schemes look like, how they happen, and what steps to take if something doesn&#8217;t seem right.
Andre Blanchard: Awareness is critical and key, and that&#8217;s exactly what we&#8217;ll focus on today. So let&#8217;s start with account takeovers and the way fraudsters try to obtain client accounts or as I like to say obtain keys to the castle.
Ryan Powell: Right. And this is that unauthorized or account takeover we spoke about a moment ago. And it often starts with an impersonation scam. These can come through a website, an email, a phone call. Essentially, the fraudster is reaching out to a business and pretending to be someone they are not. It might be an employee from the bank, it might be law enforcement or a third party.
And in these calls, their goal is usually to obtain sensitive information like confidential sign on information. Could be usernames, card numbers, passwords, tokens, or redirect the client to a fraudulent site that the fraudster controls. And through that, you know, perhaps give away that same information which would compromise the access to their banking.
Now, fortunately, businesses have added layers of protection, not just the passwords. We often have multi-factor authentication like tokens, and fraudsters in turn, have had to evolve their tactics to deceive clients into revealing those more secure methods or approving the secret keys to their accounts. Now, these scams are designed to sound convincing. The fraudster may claim there&#8217;s an urgent issue with the client&#8217;s account, that their online access has been canceled, or that new credentials need to be issued immediately.
Andre Blanchard: Exactly. And I think that kind of urgency can often catch people off guard. How does a scam like this usually happen?
Ryan Powell: There are a few common patterns. One is that someone may use a search engine to locate their banking site, instead of a trusted, saved bookmark within your browser. Fraudsters use what we call search engine poisoning to push a malicious site higher in the search results, or to place deceptive ads that look a lot like a legitimate banking page and URL, but actually go to a fraudster site.
Once the client lands on that malicious website, the fraudster may already be in a position to follow up, perhaps with a phone call and continue the scam. And we&#8217;re all used to phishing emails and smishing text messages, but they may also direct someone to a lookalike sign in page. Malicious software, remote access tools such as AnyDesk, they might be presented as a way to fix the issue with the account or device. And more recently, a common tactic is a direct phone call. The fraudster may pretend to be from the bank. They may ask the client to click a link, visit a website other than their normal banking URL, install one of those remote desktop control apps or share their credentials.
They may even tell the client that their online banking ID has been canceled, and that a new ID, pin, or passcode has been created for them. The goal is to prey on that urgency, that confusion. Make the client feel like they need to act immediately.
Andre Blanchard: So the fraudster, in essence, is really trying to take control of the interaction and keep the client from thinking through, perhaps clearly and pausing to verify.
Ryan Powell: Exactly. That&#8217;s a big part of the tactic. It&#8217;s important to understand that these are well-organized and well-funded threat actors, organized crime that are experts in psychology, and how to separate us from our money and our secrets. And bank impersonation, law enforcement, impersonation are often direct, non-technical forms of social engineering.
The fraudster makes the phone call. They are very convincing, and they use those tactics to persuade a person by phone to hand over that sensitive access, or to prove an action. They want to really take advantage of that pressure, reduce opportunities for independent verification and get the person to follow instructions in real time.
Andre Blanchard: Okay, so what are some of the warning signs that a business may be dealing with a bank impersonation attempt?
Ryan Powell: A major red flag is any unexpected call, text, or email asking you to sign on to your online banking to share your sensitive credentials like a password, or to take an urgent action related to an issue or transaction you did not initiate or report. Another warning sign is being told to access a link that is different from your regular online banking URL.
And as we said before, requests to install software or a remote desktop app should also be treated with extreme caution. And of course, if someone is claiming to be from the bank and is asking for confidential sign on information, that should immediately raise concern.
Andre Blanchard: And I think that&#8217;s a critical point. But like, what should clients remember about how the bank will communicate with them?
Ryan Powell: Well, we do reach out to our clients. We do communicate and support them through all matters of service and concerns. And clients should remember that they should be very cautious with any unsolicited outreach related to online banking access or account administration. If something feels unusual, stop and verify through a trusted channel.
The safest approach is to use your regular banking URL. Ideally, you have it saved as a bookmarked site, and when contacting the bank, do so directly through a trusted phone number that you already have on file.
Andre Blanchard: What if someone thinks they&#8217;ve received a bank impersonation call? What should they do right away?
Ryan Powell: Yeah, that&#8217;s a great question. And there are four immediate steps we should keep in mind. First, end the call. It&#8217;s always better to call back at a trusted number and better to be safe than sorry. Second, do not provide any credentials to the caller. Do not share your passwords. Do not enter them into any website other than your regular online banking URL.
Third, do not access any links the caller provides or install any remote access software. And fourth, contact your bank immediately using a trusted contact method. The faster you act, the better chance of reducing risk and protecting your business. And remember, the bank will never ask you to do something in secret.
We&#8217;ll never ask you to assist in a top secret investigation, to share a sensitive password, to move money or provide access as part of an investigation.
Andre Blanchard: All great points for us to remember. Thank you very much. Let&#8217;s turn to the second fraud type scams, you know, including business email compromise. How is that different from an account takeover?
Ryan Powell: That&#8217;s a great question as well. Instead of impersonating a bank or another trusted authority to obtain access to your account, the threat actor tries to impersonate someone within your company or provide another form of deception to persuade you to make a payment or to change payment instructions.
So, unlike an account takeover, in this case, the client is actually making the payment themselves, and a business email compromise is one of the most common examples. Here, bad actors try to trick a business in descending funds to a fraudulent account through an email that appears to come from a trustworthy source.
Now, often the message looks very legitimate. It may appear to come from a known supplier, a partner, an executive, or another contact that you may email with regularly. In some cases, it may closely resemble the style in the format of previous emails. It may even draw on email threads and exchanges you&#8217;ve had in the past, and that can make it very difficult to detect.
Andre Blanchard: Okay, so this is less about taking over an online banking credential and more about manipulating the payment process itself.
Ryan Powell: That&#8217;s right. In a business email compromise scam, the fraudster is usually trying to redirect a legitimate payment. They want the business to believe they&#8217;re paying the correct party, when in reality the funds are being sent to the fraudsters account instead.
Andre Blanchard: So walk us through how that typically would unfold.
Ryan Powell: Right. And so a business may receive an email. It looks like it&#8217;s coming from a known contact like a supplier. The email might include an invoice or updated payment instructions. And those instructions will often have some explanation of a shift in banking relationships and ask for that payment to go to a new location.
Sometimes that new account is at a different bank, sometimes it&#8217;s at a different region. It could be in a different method than what they&#8217;ve done historically. And those are all important warning signs. If the business follows those updated instructions without independently verifying them, the payment can go to the bad actor instead of the intended recipient.
Andre Blanchard: So due diligence on our client side is critical to ensuring protection here. And that&#8217;s what makes the scam so dangerous. They can be hidden inside what looks like a routine accounts payable process.
Ryan Powell: Exactly. These scams rely on normal business activity. An invoice arrives. The payment details appear to have changed. Someone is asked to process the payment quickly. If there isn&#8217;t strong verification in place, it becomes much easier for the fraudster to succeed. And as we&#8217;ll touch on next, AI can make those messages and supporting documents even more convincing.
Andre Blanchard: So what would your counsel be for businesses, um, when they receive updated payment instructions?
Ryan Powell: Well, the most important step is just to slow down, you know, stop, verify the change again using a trusted contact number. Often those emails will include a phone number. But that&#8217;s the fraudsters phone number. So it&#8217;s important to go back to the official or trusted number that you use to interact with that supplier. If payment instructions change, make a separate call out to the sender using that known number. Not just that a payment is due, but the specific payment details. That independent verification is one of the strongest defenses against business email compromise. And importantly, businesses should not accept inbound phone calls, texts or emails of verification of the change.
That verification needs to happen through a trusted, independent channel. We recognize that can take time. That&#8217;s effort for the business to do that extra work, especially if the payee might be in a different time zone or have different operating hours. But it is time well spent to ensure the money is going to the right person and not a fraudster.
Andre Blanchard: That sounds like it&#8217;s a well worth exercise, and that&#8217;s a really good distinction. So it&#8217;s not enough to simply get a reply or receive confirmation call if the fraudster actually controls those communication channels?
Ryan Powell: Exactly. Fraudsters may try to control the full conversation. They may have access to the real email address. And so independent verification is key.
Andre Blanchard: So what if this doesn&#8217;t happen the way that a client or a customer suspects? What if a fraudulent transaction has actually already been sent?
Ryan Powell: Right. Time is of the essence. So if a business believes it has sent a fraudulent transaction, it should contact its bank immediately. Time is the absolute key. The sooner the bank is aware, the sooner action can be taken and the best chance we have of intervening or recovering those funds. It&#8217;s also important internally to document what happened, preserve the email or any other communication involved, and review whether any broader compromise may have taken place.
Andre Blanchard: Ryan, thank you again for being here and having this important conversation with us.
Ryan Powell: Thanks, Andre. I appreciate the opportunity to talk about this, and I encourage businesses to stay vigilant and keep fraud awareness top of mind.
Outro: Stay tuned for part 2 of this discussion where we&#8217;ll explore how the fraud landscape continues to evolve, from phishing and mobile device takeovers to AI-generated scams and deepfakes. We&#8217;ll also share practical steps businesses can take to detect red flags, strengthen internal controls and reduce fraud risk.
Disclaimer: The materials disclosed on this podcast are for informational purposes only and subject to our Code of Conduct, as well as zero rules. The information and data contained herein has been obtained or derived from sources believed to be reliable, without independent verification by CIBC Capital Markets, and to the extent that such information and data is based on sources outside CIBC Capital Markets, we do not represent or warrant that any such information or data is accurate, adequate or complete notwithstanding anything to the contrary.
Here in CIBC World Markets, Inc. and or any affiliate thereof shall not assume any responsibility or liability of any nature in connection with any of the contents of this communication. This communication is tailored for a particular audience, and accordingly, this message is intended for such specific audience only.
Any dissemination, redistribution, or other use of this message or the market commentary contained herein by any recipient is unauthorized. This communication should not be construed as a research report. The services, securities and investments discussed in this report may not be available to nor suitable for all investors.
Nothing in this communication constitutes a recommendation, offer or solicitation to buy or sell any specific investments discussed herein. Speakers on this podcast do not have any actual, implied, or apparent authority to act on behalf of any issuer mentioned in this podcast. The commentary and opinions expressed herein are solely those of the individual speakers, except where the author expressly states them to be.
The opinions of CIBC World Markets, Inc. The speakers may provide short term trading views or ideas on issuers, securities, commodities, currencies or other financial instruments, but investors should not expect continuing analysis, views or discussion relating to those instruments discussed herein.
Any information provided here and is not intended to represent an adequate basis for investors to make an informed investment decision, and is subject to change without notice. CIBC Capital Markets is a trademark brand name under which Canadian Imperial Bank of Commerce CIBC. Its subsidiaries and affiliates provide products and services to our customers around the world.
For more information about these legal entities, as well as the products and services offered by CIBC Capital Markets, please visit www.cibccm.com.

CIBC Insights

Drivers of Growth

Business Growth

Economic Growth

Cash management chat – fraud management: Emerging threats in a changing risk landscape