Academy/Banking, Cash & Internal Controls
Fake board-president scams
An email that looks like it's from your president isn't proof it is. Here's the one habit that stops the scam every time.
A fake board-president scam is business email compromise: a scammer spoofs or hijacks an officer's email and asks a fellow board member, manager, or bookkeeper to wire money or change vendor bank details urgently. Stop it by calling a phone number already on file, never one from the message, and requiring a second person's sign-off before funds move.
How the scam works
The email looks right. It has the president's name, maybe even their real signature block, and it asks for something that sounds plausible: a wire to close on a repair contract, a change to where a vendor gets paid, all of it framed as urgent and confidential. The account behind it may be spoofed (made to look like the real address) or actually broken into.
"Business E-mail Compromise (BEC) is defined as a sophisticated scam targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments," and "a subject compromises legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds."
Source: Business E-mail Compromise: The 5 Billion Dollar Scam, FBI Internet Crime Complaint Center
The FBI names this exact scenario as one of the common patterns behind the scam.
"The e-mail accounts of high-level business executives...are compromised. The account may be spoofed or hacked."
Source: Business E-mail Compromise: The 5 Billion Dollar Scam, FBI Internet Crime Complaint Center
Swap "executive" for "HOA president" and the mechanism is identical. It works because it targets a volunteer board's biggest vulnerability: nobody wants to slow down when someone in authority says it's urgent.
Why the phone number in the email can't be trusted
The instinct is to verify by calling. That's the right idea, but only if you call a number you already had, not one the email hands you. A scammer who wrote a convincing fake request can just as easily write a convincing fake phone number.
"A fraudster who can email you fake bank details can just as easily supply a fake 'verification' phone number that rings their own desk."
Source: A vendor emailed new bank details, how do I verify a bank change request safely?, Stampli
The same logic applies whether it's a vendor changing its bank routing information or someone impersonating your president. Look up the number yourself, from a source you controlled before this email arrived: your contacts, a board roster, a prior invoice.
Three things that stop it
The FBI's own prevention guidance for this scam boils down to three habits, and none of them require special software.
"Establish other communication channels, such as telephone calls, to verify significant transactions," "Do not use the 'Reply' option to respond to any business e-mails. Instead, use the 'Forward' option," and "Verify changes in vendor payment location by adding additional two-factor authentication such as having a secondary sign-off by company personnel."
Source: Business E-mail Compromise: The 5 Billion Dollar Scam, FBI Internet Crime Complaint Center
Reading not replying matters because Reply can quietly send your response straight back to the scammer's inbox, while Forward makes you actively type or select a trusted address. Second sign-off means one board member alone should never be able to move money based on an email request, no matter how convincing it is. Write down what happened as you go: who called, which number, who confirmed on the other end, and who separately approved the payment. That record is what protects the association if the request turns out to be real, and what alerts everyone else if it doesn't.
Check yourself
Answer before you read the explanation, recalling it is what makes it stick.
An email arrives that looks like it's from your HOA president, asking the treasurer to wire $18,000 to a new vendor today. What should the treasurer do first?
A vendor emails your bookkeeper new bank routing details and includes a phone number to call to confirm. What is the safest way to verify the change?
Your board wants one more safeguard against wire fraud beyond phone verification. Which control matches the FBI's guidance for vendor payment-detail changes?
Sources
- Business E-mail Compromise: The 5 Billion Dollar Scam, FBI Internet Crime Complaint Center
- A vendor emailed new bank details, how do I verify a bank change request safely?, Stampli
Banking, Cash & Internal Controls
Build the callback habit before you need it: see Wire controls and Vendor fraud for the fuller playbook.
Whether a bank or the association absorbs a loss from a fraudulent wire often depends on the security procedure the bank offered and whether the association used it, a matter of its specific banking agreement. What verification options your bank supports, and what sign-off your own bylaws already require, vary by institution and by association.