Business Email Compromise

What is Business Email Compromise?

A type of phishing scheme, business email compromise (BEC) is a common form of cyber fraud. Cybercriminals employ social engineering techniques to manipulate victims by impersonating a trusted source and attempting to trick a victim into transferring money or sensitive data.

Cybercriminals have become sophisticated. To avoid email security filters, they do not send mass emails; instead, they target recipients, typically employees who perform regular wire transfers. They may even follow up with a phone call or perform other methods of authentication. As these communications appear to be from a legitimate source, BEC can be extremely difficult to recognize and can often go undetected.

BEC victims come from a variety of industries, ranging from small businesses to large corporations. According to the FBI’s 2017 Internet Crime Report, they received 15,690 BEC and email account compromise (EAC) complaints with adjusted losses of over $675 million.

Defend Your Business Against BEC

When receiving an email requesting confidential information, a new wire or changes to an existing wire, proceed with caution and keep the following in mind:

• Be skeptical of urgent requests that do not follow your organization’s procedures and policies even if it appears to be from a supervisor or an executive.
• Always verbally verify email requests either in person or by phone to a known number.
• Review email addresses carefully to ensure that the correct domain appears. 

Typical Methods of BEC Attack

Email Account Takeover Scenario: A cybercriminal steals the email login credentials of one of your trusted business partners (ex. a colleague, supervisor, financial institution, vendor) and sends fraudulent emails requesting confidential information or providing wire instructions.

Note: Even if the email appears to have been sent by a trusted business partner or someone within your organization, it may not be legitimate.

Impersonation Scenario: A cybercriminal sends an email which appears to be from one of your trusted business partners with a legitimate request. The cybercriminal may either use a spoof email (an email message with a forged sender address) or create a sender address that appears similar to that of your business partner. For example:

Real email address: jsmith@lbsavings.com
Fake email address: jsmith@lbssavings.com

Note: Cybercriminals may also copy electronic signatures and logos in their emails to appear credible.

BEC Cybercriminals are Savvy

Cybercriminals performing BEC attacks often make last-minute change requests to existing wires in hopes that they will not be detected prior to transfer. They will typically instruct victims to act quickly or in confidence when transferring funds.

BEC cybercriminals are known to perform extensive research to make their emails appear more credible. They often use social media sites, such as LinkedIn, to gather names, titles and other relevant information about your company.