What is Business Email Compromise and How To Prevent IT

Business email compromise (BEC) is defined asa type of cybercrime that involves fraudulent emails that are designed to trickpeople into offering up or giving away sensitive or confidential information.

BEC attacks have grown significantly over thepast few years and they are now considered to be one of the biggest threats tocorporate cybersecurity. BEC attacks jumped81% in 2022, and in that same year, the FBI’s Internet CrimeComplaint Center received 21,832 BEC complaints that accounted for more than$2.7 billion in losses. 95% of BECs typically result in a loss of between $250and $1,000,000.  

What is Business Email Compromise (BEC)?

Business Email Compromise (BEC) is a type of scam in which criminals use email fraud to target victims. These victims include both businesses and individuals and often target individuals in companies who perform wire transfer payments.

Attackers often pretend to be a high-level executive or business partner and will send an email to employees, customers, or vendors requesting them to make payments or transfer funds in some form.  Attackers, through a variety of means, can gain access to someone’s email inbox and will monitor it to pinpoint the timing of a financial transaction that they can compromise.

These attacks can cause significant financial impact to an organization as well as reputational damage and lost productivity associated with investigating and remediating an incident.

The Anatomy of a BEC Attack

BEC attacks are usually well-crafted and sophisticated, which makes them difficult to identify. An attacker usually researches a target organization and its employees to obtain knowledge about their operations, vendors, customers, and business partners. This information is usually easy to access through company websites, and social media sites like LinkedIn and Facebook.

Once an attacker has enough information, they draft a convincing email that is designed to appear that it is originating from a high-level executive or a business partner. The email typically requests the recipient to make a payment or transfer of  funds for a real estate or business transaction, a vendor payment, or tax payment.

The email usually contain a sense of urgency, compelling the target individual to respond quickly. The attacker may also use social engineering tactics such as posing as a trusted contact or creating a fake website that mimics the company’s site to make the email appear completely legitimate.

How to Prevent Business Email Compromise

BEC scams can be challenging to prevent, butthere are measures businesses and individuals can take to reduce the risks associatedwith them.

Educate Employees

Organizations should educate their employees about the risks of BEC. This includes providing training on how to identify and avoid these scams. Cybersecurity Awareness Training tools like KnowBe4, can be easily deployed across your business to help employees be more aware of these types of risks.  

Training should also include email account security, including:

• Checking sent folders regularly for any strange messages
• Using strong email passwords with at least 12 characters and ensuring multi-factor authentication is deployed
• Changing email passwords regularly
• Storing email and all business related passwords in a secure manner
• Notifying an IT contact if they suspect a phishing email

Enable Email Authentication

Organizations should implement email authentication protocols which can include:

• Domain-based Message Authentication, Reporting, and Conformance (DMARC)
• Sender Policy Framework (SPF)
• Domain Keys Identified Mail (DKIM)

These protocols help verify the authenticity of the sender’s email address and they can also reduce the risk of email spoofing. Another benefit is to keep your emails from ending up in junk mail folders.

Implement Payment Verification Processes

Organizations should deploy payment verification processes, such as two-factor authentication. Another protocol is to get confirmation from multiple parties to ensure all wire transfer requests are legitimate. It’s always better to have more than one person verify a financial payment request.

Check Financial Transactions

Organizations should check all financial transactions and monitor for irregularities, such as unexpected wire transfers or changes in payment instructions. If you don’t perform these according to as chedule, it is easier for them to get forgotten. Set up a calendar item for the review of financial transaction and use a schedule that makes sense for your business and transaction volume.

Establish a Response Plan

Organizations should establish a response plan for BEC incidents. This includes procedures for reporting the incident. As wellas freezing the transfer and notifying law enforcement.

Use Anti-phishing Software

Businesses and individuals can useanti-phishing software to detect and block fraudulent emails. As AI and machinelearning gain widespread use, these tools become more effective.

The use of AI in phishing technology continuesto increase. Businesses must be vigilant and take steps to protect themselves.

Need Help with Email Security Solutions?

The risks associated with cybersecurity are unfortunately increasing.  If you have questions or would like to learn more, give us a call today at 416-360-2646 or email us at inquiries.infoware.ca,

About Infoware

For over 40 years Infoware has been helping law firms and other professional organizations in the Greater Toronto Area work more efficiently. Our cost-effective Managed IT Services and cybersecurity programs are designed to reduce risk and improve productivity for your firm. Contact us for a quick 10-15-minute,no-obligation-free chat to see if we can help keep cybersecurity threats at bay and improve your IT operations. 

‍