The International Cricket Council lost $2.5 million after becoming target of a phishing scam in 2022, according to a report by ESPNcricinfo.
The sum was wire transferred after a scam which originated in the United States.
“The route used by fraudsters to commit the financial scam was Business E-mail Compromise (BEC), also known as e-mail account compromise,” the report stated.
“The ICC is tight-lipped about the incident because it has reported the suspected fraud to law-enforcement agencies in the USA and an investigation is underway. It is learned that the ICC Board was updated about the incident last year.
“It is not yet known what route exactly the fraudsters took to get the money transferred from the ICC account — whether they had got in touch directly with someone at the head office in Dubai, or had targeted an ICC vendor or consultant. It is also not confirmed whether the transaction was done in one single payment or there were multiple wire transfers.”
According to the Federal Bureau of Investigation (FBI), BEC is one of the most financially damaging online crimes. It exploits the fact that people rely on email to conduct business—both personal and professional.
A scammer might spoof an email account or website through slight variations on legitimate addresses ([email protected] vs. [email protected]) to fool victims into thinking fake accounts are authentic.
The scammers can also send spearphishing emails, which are messages that look like they’re from a trusted sender to trick victims into revealing confidential information.
Additionally, malicious software can also infiltrate company networks and gain access to legitimate email threads about billing and invoices. That information is used to time requests or send messages so accountants or financial officers don’t question payment requests. Malware also lets criminals gain undetected access to a victim’s data, including passwords and financial account information.