Gerry Smith of the Maui Economic Development Board Inc. (from left), Russell Adkins of Maui Brewing Co., Will Bales of FBI’s Honolulu Cyber Squad and Jason Higa of Zippy’s Restaurants discuss fraud prevention during the third annual Hawaii Small Business Conference on Wednesday at the Maui Arts & Cultural Center. The two-day conference, featuring more than 20 national and local experts, continues today with multiple workshops. CASEY NISHIKAWA photo

KAHULUI — Gone are the days of a Nigerian prince asking for a wire transfer to his African charity, according to the FBI’s Honolulu Cyber Squad supervisor, Will Bales.

Cyber scams have become much more believable, and people in Hawaii need to be wary of risks in today’s sophisticated digital age, he said.

The Hawaii Small Business Conference talk, “When Bad Things Happen to Good Companies,” featured Bales, Jason Higa of Zippy’s Restaurants and Russell Adkins of Maui Brewing Co. at the Maui Arts & Cultural Center as part of the two-day event with speakers, networking and workshops for local small businesses. While the afternoon discussion Wednesday drew scores of owners, managers, staff and aspiring entrepreneurs, its lessons are applicable for anyone.

“Paranoia is . . . they aren’t out to get out but you are just paranoid that they are,” Bales said. “They are out to get you, so you’re not being paranoid. You’re being diligent. Please be diligent in reviewing all the emails you’re getting, your clicks, the invoices you’re paying or receiving. Just have that second-guessing nature.”

Higa, CEO of FHC Enterprises, which includes Zippy’s Restaurants, Napoleon’s Bakery, Food Solutions International, Pomaika’i Ballrooms at Dole Cannery on Oahu, A Catered Experience (ACE), Kahala and Pearl City Sushi and Germaine’s Luau, recounted a data breach that started as an email with a Word attachment containing malware, or malicious software, that was downloaded Oct. 10, 2017.

In six weeks, the malware migrated from company email to Point of Sale systems. By March 2018, it had accessed customer credit and debit card data, resulting in a class action settlement for about $725,000 in claims.

An FBI probe linked the hack to FIN7, a sophisticated international criminal group responsible for a number of U.S. data breaches at restaurants and retail companies.

Since then, Zippy’s has updated its system hardware, changed the way its software and system processes work, and emphasized education for employees, Higa said. He hopes information sharing among Hawaii businesses, and talks like this, can prevent cybercrime.

“I wish I was in the audience two years ago, listening to our experiences,” Higa said. “There are threats occurring all the time. If we, in Hawaii, can share what’s going on with each other, we are better apt to mitigate cyber criminal activity.”

Higa added that joining CyberHawaii, an information sharing and analysis nonprofit that helps bolster cybersecurity, has been key for his business.

Russell, Maui Brewing Co. CFO, shared a story of how advanced cyberattacks can be.

An email that appeared to be from founder and owner Garrett Marrero, which contained his signature, said to send money to a recognized vendor. Russell said he sent the funds and then noticed something strange about the email, so he called the bank to halt the wire transfer.

“They’re duplicating everything, and they have one little letter off (in the email address),” he said, noting that phishing is more advanced today.

Russell said personal accountability is vital when it comes to cybersecurity, and he encourages business owners to know and protect all their information.

“Nobody will protect your assets better than you do,” he said.

Bales discussed tips for small business owners that include strengthening passwords and researching password management programs if they’re used. Some in his FBI office use the old-school method of writing passwords down on paper, Bales said.

“Anything digital is at risk,” he added.

Bales encouraged people not to download or click suspicious links and to make sure names are authentic. Call vendors, financial institutions and others to verify funds are being sought. He also said to be wary of last-minute changes to payment accounts.

Also, if losses more than $5,000 occur due to cybercrime, timeliness in contacting the FBI is key. If crimes are reported after a week or two, it is highly unlikely funds will be recovered, Bales said.

In 2018, the crime with the highest reported loss was Business Email Compromise, according to the 2018 Internet Crime Report.

BEC is a scam targeting businesses working with foreign suppliers and/or businesses regularly using wire transfer payments. Email Account Compromise is a similar scam that targets individuals and is carried out by fraudsters compromising email accounts through social engineering or computer intrusion techniques to conduct unauthorized transfer of funds, the report said.

The FBI is the lead federal agency for investigating cyberattacks, and complaints to the agency’s IC3 Internet Crime Complaint Center are rising each year; on average, more than 900 complaints per day are received.

In 2018, victims lost $2.71 billion. People older than 60 are the most vulnerable. The younger than age 20 victim count was 9,129 with a $12,553,082 total loss; age 20-29 victim count was 40,924 with $134,485,965 total loss; age 30-39 victim count was 46,342 with $305,699,977; age 40-49 victim count was 50,545 with $405,612,455; age 50-59 victim count was 48,642 with $494,926,300 total loss; and older than 60 victim count was 62,085 with $649,227,724 total loss.

According to 2018 statistics, the number of Hawaii victims, 1,100, ranks 42nd out of 57 in total number of complaints among states, territories and the District of Columbia. Total losses in Hawaii were $6,460,785. California was first with 49,031 victims and $450,482,128 in losses. Northern Mariana Islands were last with 15 victims and $13,865 in losses.

The Internet Crime Complaint Center’s Recovery Asset Team, established in February 2018, was created to streamline communication with financial institutions and FBI field offices to recover funds for victims. It has a 75 percent recovery rate, with 1,061 incidents that total $257,096,991.65 in losses. Out of that, $192,699,195.72 was recovered.

The third annual Hawaii Small Business Conference is presented by the Maui Economic Development Board with support from the county’s Office of Economic Development. Wednesday, presentations by national and local business leaders covered topics such as employee engagement, technology in business, video marketing, data protection, success planning and tax strategies.

Today, three-hour workshops will run parallel during morning and afternoon sessions from 9 a.m. to noon and from 1 to 4 p.m. For a list of topics and registration details, visit www.hawaiismall.biz.

For information on IC3 and its annual report, visit www.ic3.gov.

* Kehaulani Cerizo can be reached at kcerizo@mauinews.com.