Article Details
Scrape Timestamp (UTC): 2024-11-05 18:38:34.741
Source: https://www.theregister.com/2024/11/05/docusigns_envelope_bec/
Original Article Text
Click to Toggle View
Criminals open DocuSign's Envelope API to make BEC special delivery. Why? Because that's where the money is. Business email compromise scammers are trying to up their success rate by using a DocuSign API. The Envelope: create API is designed to let users of the legal signing product automate and speed up document distribution. But it also allows customization – and that combination is, we're told, causing many people to get caught out. "An attacker creates a legitimate, paid DocuSign account that allows them to change templates and use the API directly. The attacker employs a specially crafted template mimicking requests to e-sign documents from well known brands," warned bug finders at security shop Wallarm. "Because the invoices are sent directly through DocuSign's platform, they look legitimate to the email services and spam/phishing filters. There are no malicious links or attachments; the danger lies in the authenticity of the request itself." Once signed, the attacker can forward the invoices on a mass scale, thanks to DocuSign's automation features, and the money should flow into their accounts. According to the FBI, BEC scammers have made $2.9 billion from US businesses in 2023 – and that's just from the reported cases. There are undoubtedly a few embarrassed businesses that just decided to swallow the loss. Wallarm observed that the problem has been growing over the last few months and – based on DocuSign's form letter response – a remedy may take some time. The letter reads: "We appreciate you making us aware of bad actors using the DocuSign product inappropriately. Our Security teams have created an Incident Reporting guide on our Trust site. We recommend you do not click on any links from emails that are looking suspicious." As ever, the key protections are checking the sender's address and the payment details. It's a pain, but vigilance is the most effective way to defeat cyber scum.
Daily Brief Summary
Business email compromise (BEC) scammers are exploiting DocuSign's Envelope API to automate and customize fraudulent document requests.
Attackers create legitimate DocuSign accounts, alter templates, and use these accounts to mimic e-sign requests from reputable brands.
The fraudulent documents are distributed directly through DocuSign, bypassing traditional email spam and phishing filters, thereby appearing more legitimate.
Once the fraudulent documents are signed, scammers can efficiently forward invoices on a large scale, leveraging DocuSign’s automation features to collect payments.
In 2023, the FBI reported that BEC scams have cost US businesses approximately $2.9 billion, with some potentially unreported losses due to embarrassment.
Wallarm, a security firm, has observed an increase in this type of scam over recent months and noted that DocuSign’s response to the issue suggests that a remedy may not be immediately forthcoming.
DocuSign has produced an Incident Reporting guide and advises vigilance, such as verifying sender addresses and payment details, as key defenses against these scams.