By: Brittany Demendi, Corporate Communications Manager

According to Security Magazine, there has been a 150% year-over-year increase in Business Email Compromise (BEC) attacks, making them the most financially damaging type of attack. When this threat is getting worse every year, it’s no surprise the FBI named BEC the “$26 billion scam.”

So, what exactly is a BEC scam, and how do we protect against them?

This blog will dive into the details of these attacks, covering how an attack works to your defense against them.

What is Business Email Compromise?

BEC is a cybercriminal phenomenon with a high risk of severe consequences. These attacks are more likely to rise, both in frequency and losses to organizations, big or small, that fall victim. BEC is a common scam where cybercriminals pose as vendors or company employees attempting to commit wire transfer fraud, among other tactics.

The FBI reported nearly $2.4 billion in adjusted losses due to BEC scams, which is reported as 49x as much as ransomware losses in 2021. These scams are simple yet effective and have become more sophisticated as prevention methods are implemented. For example, cybercriminals use a common form of phishing called domain spoofing, where they fake a website or email domain to fool the target into clicking or responding.

BEC has been known as a low-risk, high-reward way to siphon money from organizations. The FBI calls out five primary types of BEC attacks to be aware of:

• Data Theft: Cybercriminals target human resource employees to obtain personal and confidential information about individuals within the organization, specifically executives. Cybercriminals use this information as leverage or to impersonate someone for future attacks.
• Account Compromise: Cybercriminals gain access to an employee’s email account and use it to request money from vendors. Payments are sent to bank accounts controlled by cybercriminals.
• Attorney Impersonation: Cybercriminals often impersonate legal representatives or lawyers over the phone. Lower-level or entry-level employees are targets for these attacks due to not knowing to question the authenticity of the request.
• CEO Fraud: Cybercriminals position themselves as an executive or CEO of a company. Posing as a CEO, cybercriminals typically target an employee within the finance or accounting department, requesting funds to be transferred to an account controlled by the cybercriminal. Or they request sensitive information.
• False Invoice Scheme: Cybercriminals target organizations that use foreign suppliers are the main target of this tactic. The cybercriminal impersonates the supplier requesting payments or fund transfers into an account controlled by the cybercriminals.

Techniques for Business Email Compromise: Phishing

As we have touched on in a previous blog post, phishing is an early-stage and reliable tactic used by cybercriminals to gain access to networks as a part of a more powerful attack. In other words, phishing can be used as a technique or vessel for BEC.

An example of phishing as a BEC technique is as simple as receiving an email from your IT department asking you to update your password or complete a security awareness training module. You then click the links provided in the email, not noticing the extra letter in the company email domain or the unusual URL provided.

Cybercriminals commonly use techniques like the above phishing email example to lure a potential victim into performing dangerous actions that put organizational data at risk, costing an organization a significant amount of money.

Illuminating Threats

BEC scams can be highly transactional; cybercriminals do their research targeting large corporations’ email accounts and employees who use email for daily financial transactions. From global corporations to medium and small businesses, everyone is vulnerable to BEC.

There is not one type of software or solution that can combat BEC. A suggested approach is multifaceted and multilayered, including a strategic combination of implementing cybersecurity awareness training, business email compromise simulators, behavior analytics, and multi-factor authentication.

When security teams often lack the proper resources to test their security programs, they need a tool to understand their organization’s risk to the current and evolving threats. A BEC simulator tool tests prevalent attacks while identifying areas of risk. When paired with Proactive Security Awareness, employees gain awareness and are empowered with the knowledge and skills to identify suspicious activity. While BEC simulators are testing the strength of security tools, Proactive Security Awareness uses real-life de-weaponized attack campaigns holding every employee accountable for their actions without damage to the organization.

Your Defense: Automation

BEC scams require a people-centric and automated defense that can detect, prevent, and respond to a wide range of BEC scams and phishing techniques. Automation is about leveling the playing field between cybercriminals and cybersecurity experts with the goal in mind of reducing the number of threats by eliminating vulnerabilities and risk through the prevention of identification of zero-day attacks and known cyber threats.

An automated cybersecurity solution, combined with cybersecurity experts, eliminates human error, increases agility, and reduces response time and remediation costs. In addition, security and behavior analytics assist with tracking users to ensure that an employee signing into a network is legitimate.

Email is the largest infection vector for transmitting threats, requiring a reliable solution to remain resilient. Domain authentication, email security, user awareness, and content inspectors must work together to provide the utmost protection.