Customize Consent Preferences

We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below.

The cookies that are categorized as "Necessary" are stored on your browser as they are essential for enabling the basic functionalities of the site. ... 

Always Active

Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.

No cookies to display.

Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.

No cookies to display.

Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.

No cookies to display.

Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.

No cookies to display.

Advertisement cookies are used to provide visitors with customized advertisements based on the pages you visited previously and to analyze the effectiveness of the ad campaigns.

No cookies to display.

Business Email Compromise Attacks and How to Fight Them

  • OneCall Business Email Compromise

Business Email Compromise Attacks and How to Fight Them

By |2023-06-30T17:27:48+13:0030 June, 2023|Blog, Cybersecurity, IT Services|

In recent years, email has become an essential part of our daily lives. Many people use it for various purposes, including business transactions. Along with the increasing dependence on digital technology, cybercrime has also grown exponentially. A significant cyber threat facing businesses today is Business Email Compromise (BEC).

Why is it important to pay particular attention to BEC attacks? Because they’ve been on the rise. BEC attacks jumped 81% in 2022, and as many as 98% of employees fail to report the threat. 

What is Business Email Compromise (BEC)?

Business Email Compromise (BEC) is a type of scam in which criminals use email fraud to target victims. These victims include both businesses and individuals. They especially target those who perform wire transfer payments. 

The scammer pretends to be a high-level executive or business partner. Scammers send emails to employees, customers, or vendors. These emails request them to make payments or transfer funds in some form.

According to the FBI, BEC scams cost US businesses around $1.8 billion in 2020. That figure increased to $2.4 billion in 2021. These scams can cause severe financial and reputational damage to businesses and individuals.

How Does BEC Work?

BEC attacks are usually well-crafted and sophisticated, making it difficult to identify them. The attacker first researches the target organisation and its employees. They gain knowledge about the company’s operations, suppliers, customers, and business partners. 

Much of this information is freely available online. Scammers can find it on sites like LinkedIn, Facebook, and business websites. Once the attacker has enough information, they can craft a convincing email. It’s designed to appear to come from a high-level executive or a business partner.

The email will request the recipient to make a payment or transfer funds. It usually emphasises the request being for an urgent and confidential matter. For example, a new business opportunity, a supplier payment, or a foreign tax payment. 

The email will often contain a sense of urgency, compelling the recipient to act quickly. The attacker may also use social engineering tactics such as posing as a trusted contact or creating a fake website that mimics the company’s site. These tactics make the email seem more legitimate.

If the recipient falls for the scam and makes the payment, the attacker will disappear along with the funds. In their wake, they leave the victim with financial losses.

How to Fight Business Email Compromise

BEC scams can be challenging to prevent. But there are measures businesses and individuals can take to cut the risk of falling victim to them.

1. Educate Your Employees

Organisations should educate their employees about the risks of BEC. This includes providing training on how to identify and avoid these scams. Employees should be aware of the tactics used by scammers. For example, urgent requests, social engineering, and fake websites. Trusting your instincts about emails where anything at all seems unusual, and erring on the side of caution rather than simply choosing to believe the email is genuine.

Training should also include email account security, including:

  • Checking the sent folder regularly for any strange messages that may have been sent from the account
  • Using a strong email password with at least 12 characters
  • Changing email passwords regularly
  • Storing email passwords in a secure manner
  • Notifying their IT department or company if they suspect a phishing email

2. Enable Email Authentication

Organisations should implement email authentication protocols. 

This includes:

  • Domain-based Message Authentication, Reporting, and Conformance (DMARC)
  • Sender Policy Framework (SPF)
  • DomainKeys Identified Mail (DKIM)

These protocols help verify the authenticity of the sender’s email address. They also reduce the risk of email spoofing and help keep your emails from ending up in junk mail folders.

3. Deploy a Payment Verification Process

Organisations should deploy payment verification processes, such as two-factor authentication. Another protocol is confirmation from multiple parties. This ensures that all wire transfer requests are legitimate. It’s always better to have more than one person verify a financial payment request.

4. Establish a Response Plan

Organisations should establish a response plan for BEC incidents. This includes procedures for reporting the incident, as well as freezing the transfer of funds immediately and notifying the police.

5. Use Anti-phishing Software

Businesses and individuals can use anti-phishing software to detect and block fraudulent emails. As AI and machine learning gain widespread use, these tools will become increasingly effective. 

The use of AI in phishing technology continues to increase. Businesses must be vigilant and take steps to protect themselves.

Need Help with Email Security Solutions?

It only takes a moment for money to leave your account and be unrecoverable. Don’t leave your business emails unprotected. If you’re a New Zealand business with questions about putting email security solutions in place, don’t hesitate to get in touch with our teams in Christchurch, Dunedin or Tauranga.

Article used with permission from The Technology Press. 

Contact us today
back to blog

Share this story

The Cloud

is in our DNA

Get Started
Go to Top