Elena Goukassian
Anton van Dalen
Self-Portrait with Rabbit Jumping through the
Computer, 2014
P.P.O.W
Imagine you’ve just made a deal with a gallery
to buy a piece by one of your favorite artists. You’ve worked out a price and
gotten an invoice. Then, out of nowhere, the dealer emails you: “Hello dear,
I’m sorry, I sent the wrong bank information. The attached is the updated
invoice for wire transfer.” What do you do?
The short answer is: Pick up the phone and
call your dealer. This could be someone else who intercepted your communication
and is trying to have you wire the money to their account instead. And if you
do, it’s often very hard to trace it and get it back. Emails like this are just
one example of the scams making the rounds in the art world.
“It’s been unnerving and disheartening during this pandemic. There’s just so much going on,” said Anne Rappa, senior vice president at
fine art insurance broker Huntington T. Block. “At this time, people are particularly vulnerable, since
nervousness increases error.”
Many of these scams use social engineering as a tool to convince
people to either divulge sensitive information or send money to mysterious
overseas accounts, with scammers researching specific targets in order to pose
as someone they trust. (Remember the Twitter breach earlier this month? It was
a social engineering attack on Twitter’s own employees.)
“There’s been a shift away from hacking and data breaches that
steal credit card numbers, as they became less valuable to sell,” said Robert
Rosenzweig, vice president and national cyber risk practice leader at DeWitt
Stern. “Now there’s more diversion and manipulation.”
Rosenzweig noticed a huge uptick about 18 months ago, with people
opening files that locked down their systems and demanded ransom to regain
access to data. Scammers target art galleries because their clients tend to be
wealthy; phishing scams, especially, expose a lot of collectors’ personal
information, which a scammer can use to target that person before moving on to
their connections, and then their connections’ connections. Rosenzweig
recommends getting encrypted software.
“Given the informality of the art world historically, there has
been more and more direct financial loss as a result,” he said. “But it really
is a human issue when it comes down to it.” Training people to follow specific
internal policies—knowing when to be suspicious of emails and when to pick up
the phone—are just as important as your security software. “There’s a need to
operate with heightened awareness with every means of communication,” said
Rosenzweig.
Adam Prideaux, managing director of insurance broker Hallett
Independent, remembers the first time he came across one of these scams in the
art world a few years ago, when a gallery lost £1 million (about $1.3 million).
“The heart of the problem is email as a means of communication,” he said.
“People send all their confidential information, and it’s easy to hack and see
what they are talking about.”
Hallett sees a new case of this type about once per week (a lot of
the smaller amounts lost may not be reported, or even noticed); cybertheft is
much more likely than the physical theft of an artwork. Prideaux noted there
are very simple measures galleries could put into place in order to protect
themselves, like password-protecting invoices, sending sensitive information
(including pricing details) via WhatsApp or another encrypted messaging
service, or even using good old-fashioned snail mail.
“What’s always struck me is the lack of training,” Prideaux added.
“Tech isn’t at the forefront of how the art world does business.” He said he
tells people to always assume every email they write is being read by people
other than the intended recipients.
Perhaps unsurprisingly, all of the insurance companies and brokers
consulted for this article are happy to arrange some form of cyber insurance
for galleries (many packages also come with access to forensics experts). But,
as Prideaux put it, “if you have good training, you’re managing the risk, which
negates the need for insurance. If a hacker sees passwords on all your email
attachments, he moves on to the next gallery.”
In taking steps to create a more robust cybersecurity system, the
gallery isn’t just protecting itself—it’s also protecting its collectors, who
are much more likely to lose money in a social engineering attack. If
collectors want to get personal cyber insurance and identity theft insurance,
they can do so through their homeowners policy, but ultimately, Prideaux
believes it’s galleries’ responsibility to educate both their employees and
their clients in order to “clean up the system.”
In full disclosure, Artsy’s gallery network has been the target of
similar phishing scams. To combat instances of social engineering, Artsy has
invested in its security procedures to protect partners, created a team
dedicated to trust and safety, built best-practice resources, and communicated
directly with both its users and employees so they are better educated about
the dangers of phishing scams.
In the aftermath of an uninvited third party getting between a
dealer and a collector, there’s often a great deal of finger-pointing and
accusation as to who is at fault. Most of the time, this involves figuring out
whose email got hacked and how much responsibility that party should take for
the breach—as seen in a recent case in the Netherlands.
The way to resolve these disputes is through lawyers, who determine
both parties’ rights and vulnerabilities, explained Joseph V. DeMarco, partner
at the law firm DeVore & DeMarco, where he focuses on information privacy
and security, computer intrusions, and online fraud, among other issues. He
said the first thing people tend to do when they find out what happened is
immediately fix their system. But doing so could erase essential evidence, so
it’s important to talk to experienced counsel, who “can hire a technologist to
bring systems up while preserving relevant evidence,” he said.
DeMarco said he’s even been able to recover the lost money in some
instances. When these cases go to negotiation or to court, it’s usually a
matter of determining which party is more at fault and dividing up the loss
accordingly. But it’s more important to take preventative measures, like
creating a policy that all wire transfers are confirmed face-to-face or over
the phone—or, very simply, writing in your contract: “We will never change our
wire information without verbal confirmation.”
“Amend your sales agreements, documents, and policies to bring the
odds of this happening to zero,” DeMarco said. “The best time to do it is now,
not when you’re in the middle of it,” when it would be “like changing the
batteries on a smoke detector while your house is on fire.”
In 2018, the Art Dealers Association of America organized a seminar
to educate dealers on issues of cybersecurity, inviting FBI special agent
William McKeen, who works on cybercrime cases, to participate. “Any time we can
talk to an entire industry, it really makes a difference for us,” said McKeen,
remembering an incident with a New York gallery where a scammer impersonated a
private seller of a significant piece and changed the wire instructions; the
gallery ended up wiring money to the scam account.
McKeen said the biggest red flag is usually someone reaching out in
the middle of a deal to change instructions. It’s also important to pay
attention to language, he said, as a lot of scammers might refer to a person by
only their last name or greet them with a “Hello dear.” One should also be wary of anyone applying pressure to move very quickly.
He said the art industry is particularly vulnerable to these kinds of scams
because most companies and organizations are small, with no person dedicated to
cybersecurity; large overseas wire transfers are the norm; and there are no
industry-standard invoices.
“Cybercrime is the most lucrative crime,”
McKeen added. “I’m working on a case now where the subject succeeded only 5
percent of the time and made $3.5 million in the last year.”
According to the FBI, in 2019, people in the
U.S. lost $57 million to phishing scams alone, and that’s only the reported
cases. McKeen always encourages people to report these crimes, since there are
only several thousand scammers around the world, and many of them work in
hierarchical groups, similar in structure to organized crime. “Folks are hard
to trace as they’re mostly overseas, but we’ve had success recently related to
building international relationships,” he said. “We make arrests weekly on
these kinds of cases.” (He pointed specifically to a couple of Nigerian
scammers who were caught earlier this month—at least partially due to Instagram
posts documenting their lavish lifestyles.)
As for art transactions, one specific step
McKeen suggested people take to avoid being scammed is to “find out the amount
of money you’re willing to lose. Any amount above that, have two people
authorize the transfer. Make it a part of the culture, no matter how urgent.”
This is good advice for both galleries and collectors: A second opinion—no
matter whose it is—could be the difference between acquiring a new and exciting
work and suffering a massive financial loss. If you do find yourself a victim
of a cybercrime, you can report it on the FBI’s Internet Crime Complaint Center
website. “Time is of the essence!” said McKeen. The sooner you report, the more
likely you’ll be able to get your money back.
For now, though, anytime you get a suspicious
email from an art dealer and before you open any attachments, just pick up the
phone and call the person. All the experts interviewed for this article said
this is the most effective way to confirm whether or not they actually sent you
the email. Just make sure you call a number you already have for them—don’t
trust the one in the email signature, just in case.
Elena Goukassian
https://www.artsy.net/article/artsy-editorial-art-collectors-avoid-online-phishing-scams-social-engineering?utm_medium=email&utm_source=sailthru&utm_campaign=editorial&utm_content=daily-bronze&utm_term=21037858-07-28-20
