Phishing and Social Engineering Attacks

1. Why This Topic Matters for the CTP Exam and for Treasury Practice

Treasury is the part of the organization that moves money. It initiates wires, approves ACH files, manages bank account signatories, holds credentials for online banking portals, and maintains vendor banking details. That makes treasury the single most attractive target for criminals who want to convert a lie into cash. Phishing and social engineering attacks do not break technology; they break people and processes. A firewall cannot stop an assistant treasurer from wiring $2 million to a fraudster who sent a convincing email that appeared to come from the CFO.

The AFP CTP body of knowledge places this topic under Technology in the Treasury Function because treasury technology (TMS, bank portals, ERP payment modules, email) is the delivery channel for these attacks. The exam expects you to understand how attacks are constructed, why they succeed, and, most importantly, which internal controls prevent, detect, and mitigate them. Business Email Compromise (BEC) alone accounts for billions of dollars in reported losses annually according to the FBI Internet Crime Complaint Center, and payment fraud surveys published by the AFP consistently show that the majority of organizations are targeted every year. Expect at least a few exam questions to touch this area, either directly or embedded in a payments or risk management scenario.

2. What It Is: Core Definitions

Social engineering is the manipulation of people into performing actions or divulging confidential information. It exploits human psychology rather than software vulnerabilities. Phishing is the most common form, but the family is broad:

• Phishing: Mass, generic fraudulent emails designed to harvest credentials, deliver malware, or prompt a payment. Think of a fake bank notice sent to thousands of recipients.
• Spear phishing: A targeted attack against a specific individual or small group, using personal or company details gathered in advance to increase credibility.
• Whaling: Spear phishing aimed at senior executives such as the CEO, CFO, or Treasurer, or impersonating them.
• Business Email Compromise (BEC): A scheme in which an attacker impersonates (or actually hijacks) a trusted business email account to request fraudulent payments or sensitive data. Also called CEO fraud, executive impersonation, or payment diversion fraud.
• Vendor or invoice fraud: A variant of BEC where the attacker poses as a legitimate supplier and requests a change to remittance bank details so that future payments flow to a criminal account.
• Vishing: Voice phishing by telephone, often impersonating a bank fraud department or IT help desk.
• Smishing: Phishing via SMS text messages, frequently containing a malicious link or one-time-code request.
• Pretexting: Creating a fabricated scenario (a pretext) to justify a request, such as an auditor needing account statements urgently.
• Baiting: Luring a victim with something attractive, such as an infected USB drive labeled with payroll data left in a parking lot.
• Quid pro quo: Offering a service or benefit in exchange for information, such as free IT support in return for login details.
• Tailgating or piggybacking: Physically following an authorized person through a secure door.
• Pharming: Redirecting users from a legitimate website to a fraudulent look-alike site, usually through DNS manipulation, to capture bank portal credentials.
• Clone phishing: Copying a legitimate, previously received email and replacing a link or attachment with a malicious version.
• Deepfake or synthetic media fraud: Using AI-generated voice or video of an executive to authorize a transaction; an emerging variant the exam may reference as an evolution of vishing and whaling.

3. How It Works: The Anatomy of an Attack

Most successful attacks follow a recognizable lifecycle:

Step 1 - Reconnaissance. The attacker researches the target using LinkedIn, the company website, press releases, SEC filings, social media, and prior data breaches. They learn who the CFO is, who processes wires, which banks the company uses, the names of major suppliers, and even when executives travel.

Step 2 - Preparation of the pretext. The attacker registers a look-alike domain (for example, swapping a lowercase L for a capital I, or adding a hyphen), spoofs the display name, or compromises a real mailbox through an earlier credential-phishing campaign. They may sit silently inside a compromised vendor mailbox for weeks, reading invoice threads to learn the timing and tone of real payment requests.

Step 3 - The hook. A message arrives that pairs a plausible request with a psychological trigger. Common triggers include authority (the CEO is asking), urgency (the deal closes today), secrecy (this acquisition is confidential, do not discuss with anyone), fear (your account will be suspended), trust (the message continues an existing real email thread), and reciprocity or helpfulness (please help me out, I am stuck in a meeting). The request is often timed for a Friday afternoon, month-end, quarter-end, or when a key approver is on vacation.

Step 4 - The action. The victim clicks a link and enters bank portal credentials, opens an attachment that installs malware or a keylogger, changes vendor remittance details in the ERP, or approves an urgent wire outside normal procedures.

Step 5 - Monetization and cover-up. Funds are wired to a mule account and rapidly moved again, often offshore, within hours. The attacker may delete sent items or create mailbox rules to hide bounce-backs and replies so the real account owner does not notice.

Why treasury is uniquely vulnerable: Treasury staff are expected to be responsive to executives, routinely process large and time-sensitive payments, and interact with many external counterparties. Legitimate urgency is normal, so fraudulent urgency does not stand out. Small teams and remote work can erode the informal verification that used to happen by walking down the hall.

4. Treasury-Specific Attack Scenarios You Should Recognize

• Executive impersonation wire request: An email appearing to come from the CEO instructs the treasury analyst to wire funds for a confidential acquisition deposit and to bypass the normal approval workflow.
• Vendor bank account change: A long-standing supplier emails that they have changed banks and attaches a new remittance letter on letterhead. The next three payments go to the fraudster.
• Payroll diversion: An employee or executive emails HR or treasury asking to update direct deposit details.
• Bank impersonation: A caller claiming to be from the bank fraud team asks the treasury analyst to read back a one-time passcode to verify identity, then uses it to log in and release a payment.
• Credential harvesting against the bank portal: A fake login page captures user ID, password, and token code; the attacker uses them within the token validity window.
• Compromised TMS or ERP user: Malware or stolen credentials let the attacker create a new vendor, approve an invoice, and release a payment using a legitimate user profile.
• Law firm or auditor pretext: An outside party claims to be handling a legal settlement or audit and requests confidential account information or an immediate payment.

5. Controls: How Treasury Prevents, Detects, and Responds

The exam loves controls. Organize them as preventive, detective, and corrective, and remember that layered defense (defense in depth) is always the preferred answer over any single control.

Preventive controls
• Security awareness training with simulated phishing campaigns; employees are the first line of defense.
• Out-of-band verification (callback procedures): Any payment instruction or bank account change must be confirmed by phone using a number from the master vendor file or prior records, never the number in the suspicious email.
• Dual control and segregation of duties: One person initiates, a different person approves; vendor master changes are made by someone who cannot release payments.
• Multi-factor authentication (MFA) on email, bank portals, TMS, and ERP; prefer hardware tokens or authenticator apps over SMS codes.
• Email authentication protocols: SPF, DKIM, and DMARC reduce domain spoofing; external-sender banners flag messages from outside the organization.
• Payment limits, approval thresholds, and payment templates that restrict free-form wires to unapproved beneficiaries.
• Vendor master file controls: Formal change request forms, independent verification, and a waiting period before the first payment to new instructions.
• Written policies that executives explicitly endorse, stating that no payment will ever be released based on an email alone and that staff will not be penalized for verifying.
• Least-privilege access and prompt removal of access when employees leave or change roles.
• Dedicated secure workstations for online banking and patching of browsers and operating systems.

Detective controls
• Positive pay, payee positive pay, and ACH debit blocks and filters at the bank.
• Daily reconciliation of bank activity to the ledger and prior-day reporting review.
• Bank alerts for new beneficiaries, large or international wires, and user profile changes.
• Anomaly or behavioral analytics in the bank portal or TMS flagging unusual payment patterns.
• Monitoring of email forwarding rules and impossible-travel logins.
• Internal audit testing of vendor changes and payment approvals.

Corrective and responsive controls
• A documented incident response plan covering who to call, in what order.
• Immediate contact with the originating bank to request a wire recall or hold; speed is critical because funds typically leave the mule account within 24 to 72 hours.
• Report to law enforcement (in the U.S., the FBI IC3 Recovery Asset Team) and to the receiving bank.
• Cyber insurance and crime or fidelity coverage; understand that social engineering fraud is often excluded unless a specific endorsement is purchased.
• Forensic review to determine whether mailboxes or systems were compromised, reset credentials, and remove malicious rules.
• Lessons-learned update to policies and training.

6. Exam Tips: Answering Questions on Phishing and Social Engineering Attacks

Tip 1 - Read for the attack type. Many questions describe a scenario and ask you to name it. Use these anchors: mass generic email = phishing; targeted individual = spear phishing; aimed at or impersonating an executive = whaling or BEC; phone = vishing; text = smishing; fake website or DNS redirect = pharming; physical following = tailgating; fabricated story = pretexting. If the scenario involves a request to change supplier bank details, the answer is vendor or invoice fraud, a form of BEC.

Tip 2 - Recognize that the weakness is human, not technical. If a question asks what social engineering exploits, the answer is human trust, psychology, or behavior, not software vulnerabilities. Conversely, if the question asks which attack does not rely on human interaction, that is not social engineering.

Tip 3 - When asked for the best or most effective control, favor out-of-band verification and dual control. The CTP exam consistently rewards answers that verify a payment instruction through an independent channel using previously known contact information. An answer that says to reply to the email or call the number provided in the email is always wrong.

Tip 4 - Prefer layered, multi-control answers over single-point solutions. If an option mentions a combination such as training plus MFA plus callback procedures plus positive pay, it usually beats any single technology.

Tip 5 - Watch for red-flag language in scenarios. Urgency, confidentiality, requests to bypass procedures, a change in bank details, a slightly different email domain, unusual grammar, or a request arriving while the executive is traveling are all cues that the exam writer is signaling fraud. The correct response is to pause and verify, not to comply because the request came from an authority figure.

Tip 6 - Know the response sequence. If funds have already been sent, the first action is to contact the bank immediately to attempt recall, then notify law enforcement, then internal escalation and insurance. Speed matters most; an option that begins with an internal investigation before contacting the bank is usually wrong.

Tip 7 - Distinguish prevention, detection, and correction. Training, MFA, and callbacks are preventive. Positive pay, reconciliation, and alerts are detective. Wire recall, insurance claims, and incident response are corrective. Match the control category to what the question is asking for.

Tip 8 - Remember the insurance nuance. Standard crime policies may not cover losses from voluntary payments induced by social engineering; a social engineering fraud endorsement is typically required. This is a classic distractor topic.

Tip 9 - Do not confuse related technology terms. SPF, DKIM, and DMARC are email authentication standards that reduce spoofing. MFA is an access control. Positive pay is a bank fraud-prevention service for checks and ACH. Encryption protects data in transit or at rest but does not stop a user from voluntarily sending a wire. Knowing which tool addresses which problem helps eliminate wrong answers.

Tip 10 - Think like a treasurer, not an IT administrator. The CTP exam is testing your ability to design and operate payment controls. When two answers both seem technically reasonable, choose the one that treasury actually owns and can implement: policies, approval workflows, bank services, callback procedures, and staff training.

7. Worked Example Questions

Example 1: A treasury analyst receives an email from what appears to be the CFO requesting an urgent, confidential wire to a new beneficiary to close an acquisition, with instructions not to discuss it with anyone. What should the analyst do first?
Approach: Identify the attack (BEC or whaling). Identify the red flags (urgency, secrecy, new beneficiary, bypass of procedure). Best answer: verify the request directly with the CFO through a known phone number or in person before taking any action. Wrong answers: reply to the email, process the wire because the CFO has authority, or forward to IT without verifying.

Example 2: A long-time supplier emails new banking instructions on company letterhead. Which control is most effective in preventing a fraudulent payment?
Approach: This is vendor or invoice fraud. Best answer: an independent callback to the supplier using contact information from the existing vendor master file before any change is made. Letterhead is not a control.

Example 3: Which of the following best describes pharming?
Approach: Pharming involves redirection to a fraudulent website, typically via DNS manipulation, without the user clicking a bad link. It is distinct from phishing, which depends on the user acting on a deceptive message.

Example 4: After discovering that a $500,000 wire was sent to a fraudster yesterday, what is the most important immediate action?
Approach: Contact the sending bank immediately to request a recall or freeze, then notify law enforcement. Timing is the key concept.

8. Key Takeaways to Memorize

• Social engineering targets people; technology is only the channel.
• BEC and vendor payment redirection are the highest-loss schemes affecting treasury.
• Red flags: urgency, secrecy, authority, bypassing procedures, changed bank details, look-alike domains.
• The gold-standard control is out-of-band verification using independently known contact information, supported by dual control and segregation of duties.
• Layer preventive (training, MFA, callbacks, email authentication), detective (positive pay, reconciliation, alerts), and corrective (recall, law enforcement, insurance) controls.
• In response, speed is everything: call the bank first.
• On the exam, never choose an answer that trusts the contact details or instructions contained in the suspicious message itself.