One thing is certain that cyber threats are constantly evolving. A threat you may not be aware of is called Business Email Compromise (BEC). BEC attacks are proving to be costly and damaging for companies around the globe. In this blog post, we dive into what Business Email Compromise is, and companies that may be targets and discuss how to prevent BEC.
What Businesses Are Targets of BEC?
Business Email Compromise, or BEC, is a scam that targets businesses that conduct legitimate wire transfers (transfer of funds requests). Typically, this would include banks and other financial type institutions. However, BEC attackers don’t limit themselves to banks. Google, Facebook (Meta), Toyota, non-profits, and religious organizations have all been victims of BEC, where losses were in the multiple millions of dollars. The FBI regularly reports on BEC crimes and, in 2019, reported losses domestic and international to 26 billion dollars.
What is Business Email Compromise?
In a usual BEC scenario, cybercriminals impersonate company executives to trick employees into transferring funds or divulging sensitive information that will allow for access to funds.
The Scope and Impact of Business Email Compromise
According to the FBI’s Internet Crime Report, BEC has resulted in billions of dollars of loss worldwide. Loss occurs no matter the size of the company. Even billion-dollar companies have fallen prey to this scam. The impact of BEC is not just financially, but reputations are at risk too. This emphasizes the need for awareness and prevention no matter how big or small your company is.
How Attackers Execute Business Email Compromise
BEC scams generally involve four stages.
- The attacker identifies the target. This is done through research through sites like LinkedIn and other sites. They will find employees who manage finances and know the protocols of how the company handles transactions.
- The next stage is sometimes called the grooming stage. Here, the attacker will impersonate a CEO, C-suite employee, or even a vendor and start a relationship with the victim. The attacker will eventually request a favor or assistance, often in the form of a money transfer or other financial transaction. This stage can take weeks.
- Finally, there’s the exploitation stage. The attacker will pressure the victim into transferring money, often to a ‘new’ or ‘updated’ bank account. Often times they will use urgent language.
Common Types of Business Email Compromise
BEC can take many forms of identities. According to the FBI, the most common include:
CEO Fraud: The scammer poses as the CEO or another high-ranking executive and requests an urgent wire transfer. A common scam is asking an assistant to purchase gift cards as attackers pose as a CEO.
Account Compromise: An employee’s email account is hacked and used to request invoice payments to vendors listed in the email contacts.
Fake Invoice Scheme: Attackers will impersonate a vendor or supplier and send a fake invoice.
How to Identify a Potential Business Email Compromise
Identifying a BEC attack can be challenging, given the level of sophistication involved. However, certain signs can help raise red flags:
- An email request for a secretive or urgent wire transfer
- Changes in vendor payment location or account details
- Email addresses that closely resemble the company’s actual email format
How to Prevent Business Email Compromise
Preventing BEC requires a nuanced approach. One of the most important and effective ways is educating employees about BEC and their associated red flags. Implementing two-factor authentication can add an extra layer of security to company inboxes. Regular audits of financial and IT practices can also help identify potential weaknesses.
The Role of MX Guardian for Email Security
MX Guardian’s advanced email security solutions play a crucial role in preventing BEC, spear phishing, ransom attacks, email spam, and other attacks. As a cloud-based email, spam, and malware filtering service., it works seamlessly behind the scenes to protect from viruses, DoS attacks, and other email threats. Whether it’s billions of dollars at stake or thousands, email security is no longer an option. It’s a must in today’s world.
Don’t wait until it’s too late. Strengthen your company’s defenses today with our email security solutions. Contact us for a free demo, more information, or to discuss customized solutions for your business.