Closing Management Gaps: Making Digital Asset Operations Traceable

A seemingly routine email requesting a change to a payment account caused a Singapore-based commodities trading company to mistakenly transfer US$6.6 million to a fraudulent account in April 2026. Fortunately, the police later succeeded in recovering the funds through cross-border cooperation.

The fraudsters used a fake domain that closely resembled that of the legitimate supplier, simply reversing two letters in the original domain name. Posing as the supplier, they notified the company that the payment account had been changed. It was not until the real supplier stated that it had never changed its bank account information that the company realized it had fallen victim to a Business Email Compromise (BEC) scam.

Jo-Fan Yu, Director and CEO of the Taiwan Network Information Center (TWNIC), explained that after a major cybersecurity incident of this kind, businesses need to do more than determine whether a request was genuine or fraudulent. Their ability to quickly reconstruct where the payment request came from, what verification steps were taken, and who approved and executed the transaction directly affects their ability to cooperate with investigations and intercept the flow of funds. When verification results can be cross-checked against registration data and operational records, digital trust becomes truly traceable.

▲ Jo-Fan Yu, Director and CEO of the Taiwan Network Information Center (TWNIC)

A Blind Spot in Domain Management: When Outsourcing Management Becomes Outsourcing Ownership

Yu emphasized that domain names are among the most important forms of online identification for businesses in the digital age, and their registration and management arrangements must be clearly defined.

Behind a single website, there are often multiple parties involved, including internal corporate teams, web design companies, hosting providers, and email service providers. A company’s first priority should therefore be to know exactly under whose name its official domain is registered and who holds the day-to-day administrative privileges.

TWNIC’s WHOIS service provides the public with a way to look up publicly available registration information for .tw and .台灣 domain names.

In practice, however, companies frequently encounter a serious governance blind spot: outsourced management gradually turns into “outsourced ownership.”

Yu stressed that the registration, renewal rights, and account control of core domain names must remain firmly within the organization. If these are controlled by an external vendor, a routine transition—such as changing service providers or an employee leaving—can easily escalate into a serious disruption of website and email services.

▲ TWNIC WHOIS Lookup: https://twnic.tw/dnservice/register/

To achieve the governance goal of traceability, companies should maintain a detailed domain inventory that records registration accounts, registrars, domain expiration dates, and the individuals responsible for domain administration. This information should be updated whenever a domain is renewed or responsibilities are transferred.

However, simply knowing who currently manages a domain is not enough. Critical actions—including domain transfers, changes to website address configurations, and modifications to administrative privileges—should be documented much like a maintenance history. Records should clearly identify who requested the change, which account carried it out, when the change was made, and what authorization supported it. This enables a company to quickly reconstruct every step of a service change when an abnormal event occurs.

When preventing email fraud, email systems likewise need to preserve digital evidence that can be cross-checked. When suspicious payment instructions are received, corporate IT teams should retain the original email together with its complete headers and compare them against sender information and authentication results contained in DMARC reports. This can help identify possible domain impersonation at an early stage.

Yu noted that the value of maintaining well-organized data and complete records in normal operations becomes clear when an incident occurs: companies can quickly provide verifiable evidence for internal investigations and incident response, as well as when reporting the matter to law enforcement or cybersecurity authorities.

Account Management Is a Fundamental Part of Traceability

Of course, traceability depends on the reliability of the records themselves.

If multiple employees share the same account, it may be impossible after an incident to determine who actually performed a particular action. Likewise, if system logs can be freely modified, the credibility of any subsequent reconstruction will be significantly weakened.

Companies should therefore use individual accounts that clearly distinguish one user from another and strictly control access to system records. For critical digital assets such as domain names, the management of administrative accounts is particularly important.

In 2024, Squarespace experienced a series of domain hijacking incidents in which certain domain-management accounts were compromised, allowing attackers to make unauthorized changes to domain settings and DNS records. Squarespace’s subsequent investigation indicated that the incidents involved weaknesses related to its OAuth login mechanism, and the company later strengthened identity verification and anomalous-activity detection measures.

The incident highlights the importance of avoiding shared accounts for users who can access sensitive information. Companies should provide individually identifiable accounts, restrict data access according to job responsibilities, and retain complete activity logs. Only then can they trace the actual user and access behavior when abnormal activity occurs.

When ownership records and critical operations leave behind a clear and reconstructable trail, companies are better able to establish the facts when a crisis occurs.

Yu emphasized, however, that keeping records alone is not enough. When an abnormal event occurs, who is responsible for making decisions and handling the consequences?

This is where digital trust must move one step further—from being merely traceable to becoming a matter of accountability.