UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 12.8 Free with a free account
How Businesses Become Targets: Financial Fraud, Data Theft, and Corporate Espionage
Ethics in Technology · Chapter 12: Cyber Harassment, Cybercrime, and How Digital Criminals OperateSection 12.8 · lesson 74 of 11614 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Why People, Not Just Technology, Are Often the Weakest Link in Security →← The Weak Points in Systems and Human Behavior That Criminals Exploit Most OftenNext lesson: Why People, Not Just Technology, Are Often the Weakest Link in Security →
In this lesson
Financial fraud, data theft, and corporate espionage exploit different valuable assets.
- Explain the combination of money, data, scale, and everyday trust.
- Compare invoice fraud with payroll diversion and verify payment changes.
- Explain data resale and the continuing harm of stolen records.
- Distinguish trade-secret theft and insider risk, then choose layered safeguards.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,675 words). Read along, or search it.
Cyber Harassment, Cybercrime, and How Digital Criminals Operate
How Businesses Become Targets
A business can offer digital criminals money, information, and valuable competitive knowledge in one place. Its everyday workflows also depend on employees trusting vendors, colleagues, and routine requests. We will explain why this combination can make organizations attractive targets. Then we will compare invoice fraud with payroll diversion. Both redirect money, but they impersonate different people and affect different payment flows. A separate trusted verification channel can interrupt the deception. We will also examine how stolen data can be resold and misused after the original breach. Trade-secret theft creates another threat to information that provides a competitive advantage. An insider’s legitimate access can make improper transfers harder to distinguish from normal work. Finally, we will connect warning signs with payment controls, access limits, and fair review. The goal is a practical process that protects assets without treating every unusual event as proof of theft.
Why Businesses?
One Organization Combines Money, Information, and Routine Trust
Businesses regularly handle vendor payments, payroll deposits, and larger financial transfers. One deceptive request may therefore redirect much more money than a small individual scam. Organizations also hold customer, employee, payment, health, or login information at scale. That information may support identity misuse, account takeover, resale, or further deception. Formulas, processes, and other protected business knowledge can be valuable to competitors. Routine human trust connects these assets to everyday work. Employees open attachments, approve requests, and respond to messages while managing time pressure. Criminals may impersonate a familiar person at the moment a payment or change is expected. The bank itself does not have to be hacked when an authorized employee sends the funds. Smaller organizations can also hold valuable information, while their defenses and circumstances vary. Assess the combination of assets, access, and workflow, rather than assume every business has identical exposure.
Invoice Fraud
A Familiar Invoice Can Hide an Unfamiliar Destination
Invoice fraud involves a criminal posing as a vendor or supplier. The message may refer to a genuine project and an expected payment amount. Familiar writing or an existing conversation can make changed instructions seem ordinary. Sometimes compromised communications supply those details, but not every scheme follows that route. The critical alteration is the payment destination, now controlled by someone other than the legitimate recipient. Accounts payable staff may approve it because the rest of the invoice looks routine. Pause when banking details change, especially if the request adds urgency or asks to bypass approval. Confirm the change through an independently established channel, such as a known vendor number on file. Do not obtain the confirmation number only from the suspicious message. Replying in the same email chain does not provide independent verification. Correct project details and a familiar display name are credibility cues, rather than proof of authorization.
Payroll Diversion
The Employee’s Paycheck Is Redirected by an Unverified Change
Payroll diversion redirects an employee’s paycheck by changing its deposit destination. The source example involves impersonating an employee in a request to HR or payroll. A fraudulent message asks staff to update direct-deposit information before the next payment. Large organizations may process many changes and may not personally recognize every employee. That workload can hide an impersonation attempt among ordinary requests. It also makes a consistent, scalable verification process especially valuable. Confirm identity and authorization through a trusted existing channel before changing banking information. Use the approved authenticated change process, with appropriate independent confirmation. Protect payroll accounts with supported multifactor authentication, because account takeover is another diversion route. Employees and staff should promptly review unexpected change notifications or missing deposits. Scale does not make verification impossible or optional; design controls that work reliably under the actual workload.
Compare the Schemes
Vendor Payment and Employee Pay Have Different Owners
Compare who is impersonated first: invoice fraud claims to be a familiar vendor. The payroll example claims to be the employee whose deposit information is changing. Invoice fraud redirects an outgoing supplier payment. Payroll diversion redirects the employee’s paycheck. In each case, bank destination information is the critical altered detail. The vendor scheme targets accounts payable or finance, while the employee scheme targets HR or payroll. Unexpected changes, urgency, and pressure to skip the process are useful warning signs. For a vendor payment, independently confirm the change and follow payment approval. For payroll, authenticate the employee and the requested change before updating the records. Both defenses depend on established trusted contact information, rather than details supplied in the suspicious request. The shared pattern is impersonation and redirection, but the correct verification process depends on who owns the payment.
Payment-Fraud Pattern
Recognize the Chain and Interrupt It at Several Points
The source’s invoice example describes research, impersonation, redirection, and movement of stolen funds. Treat that chain as a common pattern, rather than a required sequence for every scheme. Research may exploit information about vendors, executives, projects, and payment routines. Limit unnecessary public detail and protect the accounts containing sensitive business conversations. During impersonation, a message appears to come from a trusted contact. Verify identity through established channels; familiar wording alone is insufficient. At redirection, a request changes where the money will go. Independent bank-change confirmation and proper approval can interrupt that stage. If fraud is suspected after payment, promptly contact the financial institution and designated response staff. The FBI also advises reporting suspected business email compromise to its Internet Crime Complaint Center. Preserve relevant communications and transaction information through the response process; quick action can help, but recovery is not guaranteed.
Data Resale
The First Theft Can Enable Many Later Harms
Some criminals seek business information instead of an immediate payment. Customer names, addresses, identifiers, payment details, medical records, and login credentials can support different forms of abuse. Data resale means selling stolen information to other criminals. Because information can be copied, the same records may reach multiple buyers. Names and identifiers can help with identity misuse or targeted deception. Useful payment information can enable unauthorized financial activity. Sensitive records also create privacy harms, even when financial misuse is not immediate. Login credentials can enable account takeover or further unauthorized access. Discovering the original breach does not automatically retrieve every copy or end every possible later misuse. A small retailer or service provider may also hold useful customer information. The value depends on the actual records and intended misuse; organization size alone does not settle the risk.
Trade Secrets
Secrecy Alone Is Not the Entire Legal Definition
A trade secret is more than information a company simply labels confidential. Federal law requires reasonable measures to preserve secrecy and economic value arising from that secrecy. Information must not be generally known or readily obtainable through proper means. A formula, manufacturing process, customer compilation, or pricing strategy may qualify when those conditions are met. Trade-secret protection differs from a patent’s public disclosure and granted rights. It does not depend on publicly registering the secret itself. Legal protection can address improper acquisition, use, or disclosure. Ordinary hiring for general skills does not automatically constitute misappropriation. Independent development and lawful acquisition differ from taking protected business information. Secrecy, economic value, reasonable measures, duties, and actual conduct all need attention. Explain the business importance and the legal qualification separately, rather than assume every customer list is protected identically.
Competitors and Espionage
A Rival May Seek an Improper Shortcut to Valuable Knowledge
A rival may want a shortcut to valuable information. It might seek to avoid research costs, copy a process, or anticipate confidential pricing. Unauthorized intrusion is one potential route to protected files. Improperly inducing someone to breach a secrecy duty can be another. But recruiting an experienced employee is not automatically trade-secret theft. General skills and lawful competitive learning differ from transferring another business’s protected secrets. A copied file raises questions about permission, secrecy duties, legal protection, and knowledge of improper acquisition. Even a similar product does not by itself prove the competitor stole a secret. A business can develop information independently or obtain it through lawful means. Assess the actual conduct and information, rather than treat rivalry itself as evidence of a crime. This distinction protects legitimate competition while recognizing that information theft can cause substantial competitive harm.
Insider Risk
Legitimate Access Can Make Improper Transfers Harder to Notice
An insider has authorized access through a relationship such as employment or contracting. Insider threat can include intentional misuse or unintentional harm. This part of the lesson focuses on improper copying or transfer of protected information. An employee may already have the files needed for ordinary work. A download, personal-email transfer, or portable-device copy can therefore resemble routine activity. That makes contextual review more useful than assuming all access is harmless or all copying is theft. Authorized reviewers can examine unusual volume, destinations, or access beyond current job needs. Assess the relevant permission, task, policy, and evidence. Review access when people change roles or leave, including contractors and third parties. A resignation or a large authorized project download alone does not prove wrongdoing. Warning signs call for fair inquiry, with appropriate privacy and employment protections, rather than automatic accusation.
Layered Safeguards
Payment Controls and Data Controls Address Different Failure Points
Businesses need payment controls and information controls because the risks involve different assets. Verify changes to bank information through independently trusted channels. Use authenticated change processes and clear approval authority. For data, limit access to legitimate job needs and protect the accounts that can reach it. Appropriate logging and authorized review can help identify unusual transfers. For trade secrets, identify protected information and maintain reasonable secrecy measures. Clarify what use and transfer are authorized. When roles change or employment ends, remove access no longer needed through a documented process. Train staff to report suspicious requests and give them a workable escalation route. Finance, HR, IT, and legal staff may need to coordinate a suspected incident. Make protection routine under real workload, while keeping monitoring proportionate and respectful of legitimate work and applicable rights.
Review and Apply
Explain the Asset, the Deception, and the Appropriate Safeguard
Begin the review with why a business can be an attractive target. Money, data, competitive knowledge, scale, and routine trust can create a valuable opportunity. Invoice fraud uses a plausible vendor request to change the payment destination. Project details may be correct while the bank information is false. Payroll volume and unfamiliar staff relationships can hide an impersonated employee’s change request. A consistent independent verification process counters that risk. Stolen information can be copied, resold, and reused, so harm may continue after the breach is discovered. Insider theft can be harder to notice because job access and transfers resemble ordinary work. Review context and evidence, while protecting information and reassessing permissions. Use trusted channels for banking changes and layered controls for valuable records and secrets. A warning sign is a reason to verify; it is not a substitute for proof.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About How Businesses Become Targets: Financial Fraud, Data Theft, and Corporate Espionage
What is invoice fraud, and how can a business stop it?
What is payroll diversion fraud?
What legally counts as a trade secret?
What happens to customer data after a company is breached?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →