With the increasing dependence on digital technology, cybercrime has grown. A significant cyber threat facing businesses today is a phishing attack known as Business Email Compromise (BEC).
BEC attacks jumped 81% in 2022, and as many as 98% of employees fail to report the threat. With the rise of AI, BEC attacks are also becoming more convincing. So how can you avoid falling for these scams?
WEBIT Services created SecureBIT to help businesses simplify security. We are passionate about using education, not fear, to help companies make informed IT Security decisions and investments based on facts and their risk tolerance.
By reading this article, you will learn what makes a BEC attack, how they work, and six tips to reduce your risk of falling for one of these attacks.
What is Business Email Compromise?
Business Email Compromise (BEC) is a scam that utilizes email fraud to target victims. BEC attacks often target those who perform wire transfer payments, but as these attacks become more widespread, anyone can be a target.
The scammer pretends to be a high-level executive or business partner. Scammers send emails to employees, customers, or vendors. These emails request them to make payments or transfer funds in some form.
According to the FBI, BEC scams cost businesses around $1.8 billion in 2020. That figure increased to $2.4 billion in 2021. These scams can cause severe financial and reputation damage to companies and individuals.
How Does BEC Work?
BEC attacks are usually well-crafted and sophisticated, making it difficult to identify them. The attacker first researches the target organization and its employees. They learn about the company’s operations, suppliers, customers, and business partners.
Much of this information is freely available online. Scammers can find it on social media sites like LinkedIn, Facebook, and organizations’ websites. Once the attacker has enough information, they can craft a convincing email that appears to come from a high-level executive or a business partner.
The email will request the recipient to make a payment, transfer funds, or make a purchase. It usually emphasizes the request being for an urgent and confidential matter.
The email often contains a sense of urgency, compelling the recipient to act quickly. The attacker may also use social engineering tactics, such as posing as a trusted contact or creating a fake website that mimics the company’s site. These tactics make the email seem more legitimate.
If the recipient falls for the scam and makes the payment, the attacker will make off with the funds. In their wake, they leave the victim with financial losses.
How to Fight Business Email Compromise
BEC scams can be challenging to prevent, but there are measures businesses and individuals can take to reduce the risk of falling victim to them.
1. Educate Employees
Organizations should educate their employees about the risks of BEC, how to identify potential BEC attacks, and how to avoid these scams.
Training should also include email account security, including:
- Checking their sent folder regularly for any strange messages
- Using a strong email password with at least 12 characters
- Changing their email password regularly
- Storing their email password in a secure manner
- Notifying an IT contact if they suspect a phishing email
2. Enable Email Authentication
Organizations should implement email authentication protocols.
This includes:
- Domain-based Message Authentication, Reporting, and Conformance (DMARC)
- Sender Policy Framework (SPF)
- DomainKeys Identified Mail (DKIM)
These protocols help verify the authenticity of the sender’s email address. They also reduce the risk of email spoofing.
3. Deploy a Payment Verification Process
Organizations should deploy payment verification processes, such as two-factor authentication.
Another protocol is confirmation from multiple parties. This ensures that all wire transfer requests are legitimate. It’s always better to have more than one person verify a financial payment request.
4. Verify Financial Transactions
Organizations should check all financial transactions. Look for irregularities, such as unexpected wire transfers or changes in payment instructions.
If you don’t perform these according to a schedule, they can easily get forgotten. Set up a calendar item for the review of financial transactions. Use a schedule that makes sense for your business and transaction volume.
5. Establish a Response Plan
Organizations should establish a response plan for BEC incidents. The plan should include procedures for reporting the incident, freezing the transfer, and notifying law enforcement.
6. Use Anti-Phishing Software
Businesses and individuals can use anti-phishing software to detect and block fraudulent emails. These tools become more effective as AI and machine learning gain widespread use.
The use of AI in phishing technology continues to increase. Businesses must be vigilant and take steps to protect themselves.
Next Steps to Protect Your Organization from BEC Attacks
BEC attacks are a growing threat to businesses and individuals alike. These cleverly disguised emails will ask for finances or purchases on behalf of an executive or high-ranking team member.
To reduce the risk of falling for BEC attacks, businesses should:
- Educate employees.
- Enable email authentication.
- Deploy a payment authorization process.
- Verify financial transactions.
- Establish a response plan.
- Use anti-phishing software.
If you are unsure of your organization’s email security tools or practices, talk to your IT provider or internal IT team.
If you don’t currently have security tools or practices, your IT provider or team can help you find ones that will best meet your company’s security needs.
Suppose your IT provider or team does not know what you’re using, does not encourage use, or refuses to employ proper security practices outlined by a security framework. In that case, it may be time to reconsider your partnership.
WEBIT Services has been identifying and managing risk for small to medium sized businesses for almost 30 years.
If you’re looking for security answers, book a call with our team to see how SecureBIT can help simplify security.
If you are not ready to make a commitment but want to learn more about cybersecurity and email security, we recommend the following articles: