An employee in the accounting department receives an email containing a demand for payment tot services performed by a vendor However, the vendor is…

The scenario describes an "invoice scam," also known as a false invoice scheme. This

is a form of financial fraud where an attacker sends a fraudulent invoice for goods or

services not actually rendered, or from a non-existent or unapproved vendor, with

the aim of tricking the recipient into making a payment to an account controlled by the

attacker. The fact that the vendor is not in the vendor management database is a key

indicator of this type of scam.

· A. Pretexting: Pretexting is the creation of a fabricated scenario to obtain

information or illicit an action. While an invoice scam uses a pretext (e.g., a

legitimate-looking invoice), "invoice scam" is the more specific description of the

overall fraudulent activity itself.

· B. Impersonation: Impersonation involves an attacker pretending to be a legitimate

entity. While the sender of the fraudulent invoice is impersonating a vendor (even if

fictitious), "invoice scam" more comprehensively describes the entire fraudulent event,

not just the act of impersonation.

· C. Ransomware: Ransomware is a type of malicious software that encrypts a victim's

files and demands payment for their decryption. This scenario involves a fraudulent

payment request, not file encryption, making ransomware an incorrect choice.

1. Invoice Scam (as part of Business Email Compromise):

o Microsoft Security. (n.d.). What is business email compromise (BEC)? Microsoft.

Retrieved from https://www.microsoft.com/en-us/security/business/security101/what-is-business-email-compromise-bec

Specifically, refer to the section "Common types of BEC attacks," which describes "False

invoice scams."

2. Pretexting:

o National Institute of Standards and Technology (NIST). (n.d.). Pretexting. CSRC

Glossary. Retrieved from https://csrc.nist.gov/glossary/term/pretexting

Definition: "The act of creating and using an invented scenario (the pretext) to engage a

targeted victim in a manner that increases the chance the victim will divulge information

or perform actions the attacker would like them to perform."

3. Impersonation:

o National Institute of Standards and Technology (NIST). (n.d.). Impersonation. CSRC

Glossary. Retrieved from https://csrc.nist.gov/glossary/term/impersonation

Definition: "An attack where an adversary successfully assumes the identity of one of

the legitimate parties in a system or in a communications protocol."

4. Ransomware:

o National Institute of Standards and Technology (NIST). (n.d.). Ransomware. CSRC

Glossary. Retrieved from https://csrc.nist.gov/glossary/term/ransomware

Definition: "A type of malicious software (malware) that blocks access to a computer

system or data, usually by encrypting it, until the victim pays a fee to the attacker."