SEC Warns Companies Of Potential Internal Accounting Control Violations With Business Email Compromise

Key Points

• The SEC issued guidance in the form of a rare “21(a) report” this week after investigating a series of email frauds impacting 9 unnamed companies.
• These email-based frauds, referred to as “CEO scams” or “vendor scams,” were technologically unsophisticated attacks involving millions of dollars of unauthorized or misdirected wire transfers.
• Although the SEC declined to penalize the potentially offending companies, this Report signals the SEC’s continued interest in the cybersecurity area, and companies are well-advised to review and bolster policies currently in place to guard against these sorts of attacks.

Following the SEC’s announcement of its first Identity Theft Red Flags Rule enforcement action stemming from a cybersecurity breach, the SEC has published a Section 21(a) Report detailing an investigation into public companies that were victims of cyber-related frauds perpetrated via email.  In the report, the SEC identifies a particular