Sciextor

Business Email Compromise

BEC is a type of cybercrime where the scammer uses email to trick someone into sending money or divulging confidential company information.

The scammer poses as a trusted figure, such as a CEO, a supplier, or a customer, and sends a fraudulent email request to the victim.

The request may ask for a payment to a new account, a change in bank details, a wire transfer, or a purchase of gift cards.

The request may also ask for sensitive data, such as tax records, employee information, or account credentials.

The scammer often uses social engineering techniques, such as spoofing the email address or domain name, impersonating the sender’s writing style, or referencing personal or business details.

Some statistics on BEC are

• There are 15,208 BEC incidents per year on average worldwide.
• BEC costs an estimated $8.6 billion per year globally.
• BEC fraud costs $43 billion between 2016 and 2021.
• BEC rose by 14% overall in 2020 and up to 80% in some sectors.
• Experts estimate that 65% of organizations faced BEC attacks in 2020.
• BEC costs increased rapidly in just one quarter last year, from $54,000 in Q1 2020 to $80,183 in Q2.
• BEC is a serious threat that can cause huge financial losses and reputational damage to individuals and organizations.

What can you do

• Educate yourself and your staff on how to recognize and report BEC attempts. You should be wary of any unsolicited or unexpected emails that ask you to provide personal or financial information, or to click on a link or open an attachment. You should also verify the sender’s identity and the authenticity of the message, and use spam filters and anti-phishing software to block or detect phishing messages
• Use a secure email solution that can flag and delete suspicious emails or alert you that the sender is not verified. You should also check the email addresses and domains of the senders, as they may be slightly altered or spoofed to look like the real ones. For example, if the real address is: [email protected], the spoofed address might be: [email protected]. You can hover over the sender name (header) to see the detailed email address
• Implement multi-factor authentication (MFA) on all your business and personal email accounts. MFA adds an extra layer of security by requiring you to enter a code, answer a question, or use a device to verify your identity, in addition to your password. This can prevent unauthorized access to your email accounts, even if your password is compromised
• Prevent email typosquatting by registering common misspellings of your domain name and using a service that can detect and block similar-looking domains. Typosquatting is a technique that involves creating fake domains that look like the real ones, but have slight variations in spelling or punctuation. For example, if your domain is: contoso.com, a typosquatter might register: contos0.com or contoso.co. These domains can be used to send phishing emails or redirect users to malicious websites
• Implement email verification by using digital signatures, encryption, or other methods to ensure the integrity and security of your email communication. Email verification can help you confirm that the email you received is from the sender you intended, and that it has not been tampered with or altered in transit
• Develop effective security controls by using firewalls, routers, or load balancers to filter or distribute incoming requests. You should also have a contingency plan to switch to alternative servers or services in case of an attack. You can also use cloud-based services or third-party providers to mitigate the attack
• Limit public display of personal information by avoiding posting or sharing details about your work, schedule, contacts, or projects on social media or other online platforms. Cyber attackers can use this information to research their targets and craft convincing BEC emails. You should also review your privacy settings and permissions on your online accounts, and delete or deactivate any unused or old accounts