What is Business Email Compromise (BEC)?
Business email compromise, abbreviated as BEC, is a type of cyber threat that targets companies through their email systems. It usually involves cybercriminals impersonating high-ranking executives or trusted business partners to manipulate employees, customers, or vendors into performing actions or sharing sensitive information that benefits the criminals.
The sophistication of these scams often makes them difficult to detect. They do not rely on traditional phishing methods, like sending malicious links or attachments. Instead, they use social engineering and identity theft tactics. BEC scams often start with extensive research on the target company and its executives, followed by carefully crafted emails that appear legitimate.
Preventing business email compromise should be a priority for every company. It’s not just about the potential financial loss but also about the damage to the company’s reputation and customer trust.
Common Types of BEC Attacks
BEC attacks can have a devastating effect on an organization. The common types of BEC attacks include CEO fraud, account compromise, false invoice scheme, and attorney impersonation.
CEO Fraud
CEO fraud, also known as impersonation fraud, is a common type of BEC attack where the cybercriminals pose as the CEO or another high-ranking executive of the company. They typically use email spoofing techniques to make their emails appear as if they are coming from the executive’s official email address.
In these attacks, the “executive” often urgently requests a wire transfer to a certain bank account, citing some business emergency. The success of this scam relies on the power dynamics in a company, where employees are likely to follow the instructions of their superiors without questioning.
Account Compromise
In an account compromise attack, the cybercriminals gain unauthorized access to an executive’s email account. They can then monitor the account’s activity, gather sensitive information, and send emails directly from this account, making their actions appear legitimate.
The compromised account could belong to anyone in the company, but those of executives are especially lucrative due to the level of access and authority they possess. Once in control, the criminals can manipulate employees, customers, or vendors to perform actions that benefit them, such as transferring funds or sharing confidential data.
False Invoice Scheme
False invoice schemes are another common type of BEC attack, where the scammers pose as a trusted vendor or supplier. They send an invoice for a product or service that seems legitimate but is actually fraudulent.
The invoice often includes new payment details, with an excuse that the vendor’s usual bank account is under audit or has been compromised. If the recipient fails to verify this information and pays the invoice, the funds go directly to the scammer’s account.
Attorney Impersonation
In attorney impersonation attacks, the fraudsters pretend to be a lawyer or a representative from a law firm supposedly working with the company. These attacks usually involve urgent and confidential matters that require immediate action, such as a secret merger or acquisition.
The impersonated attorney may pressure the recipient to transfer funds for a supposed legal matter or share sensitive information, supposedly protected by attorney-client privilege. As these emails often come at the end of the business day or work week, the recipient may feel pressured to act quickly, without proper verification.
5 Preventive Measures Against BEC
Strong Email Authentication Protocols
An essential first step in preventing business email compromise is implementing strong email authentication protocols. This involves the use of mechanisms like Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).
SPF helps verify that an email is coming from a trusted source by checking the sender’s IP address against a list of authorized IPs. On the other hand, DKIM involves digitally signing each outgoing email, which the recipient’s server can then verify. DMARC, the most comprehensive of the trio, uses both SPF and DKIM to authenticate emails and specifies what to do with messages that fail authentication.
These robust authentication protocols make it harder for attackers to spoof emails, thereby significantly reducing the chances of BEC. However, they are not foolproof and should be used in tandem with other security measures.
Establishing Multi-Factor Authentication (MFA)
MFA adds an extra layer of security by requiring users to provide two or more forms of identity verification. This typically involves something the user knows (like a password), something the user has (like a mobile device), and something the user is (like a fingerprint).
By implementing MFA, even if an attacker manages to steal a user’s password, they’ll still be unable to access the account without the additional verification factor. This greatly reduces the risk of BEC, as most attacks rely on compromising a single form of authentication.
MFA can be implemented across all business systems, but it’s particularly crucial for email accounts. The small inconvenience of an extra verification step is a worthy trade-off for the enhanced security it provides.
Advanced Email Security Solutions
Despite strong authentication protocols and MFA, some sophisticated BEC attacks may still get through. This is where advanced email security solutions come in. These tools use technologies like machine learning and artificial intelligence to identify and block suspicious emails.
Some solutions analyze the behavior of users to establish a baseline and then flag any deviations from this norm. Others scan email content for suspicious links or attachments, while some even verify the sender’s identity by comparing their writing style against previous emails.
The key is choosing a solution that fits your business needs and budget. Regardless of the specific tool, an advanced email security solution is a powerful weapon in preventing business email compromise.
Creating a Response Plan for BEC Incidents
Despite all precautions, BEC incidents can still occur. When they do, it’s essential to have a response plan in place. This plan should outline the steps to be taken immediately after detecting a BEC incident, including isolating affected systems, notifying relevant parties, and initiating an investigation.
A well-crafted response plan can significantly mitigate the damage caused by a BEC incident. It ensures a swift and coordinated response, preventing the incident from escalating and reducing recovery time.
Remember, a response plan is only as good as its implementation. Regularly test and update the plan to ensure it stays effective.
Employee Education and Training
Finally, the human element cannot be ignored when preventing business email compromise. Employees are often the first line of defense against BEC, and therefore, their education and training are paramount.
Training should focus on identifying phishing emails, which are often the starting point of BEC attacks. It should also highlight the importance of verifying unusual requests, especially those involving financial transactions.
Regularly update the training to cover new techniques used by attackers. Also, consider running simulated attacks to test employee awareness and response.
In conclusion, preventing business email compromise is a multi-faceted effort involving technical measures, comprehensive planning, and continuous education. By implementing these five preventive measures, businesses can significantly reduce their vulnerability and safeguard their operations against BEC.
Author Bio: Gilad David Maayan
Gilad David Maayan is a technology writer who has worked with over 150 technology companies including SAP, Imperva, Samsung NEXT, NetApp and Check Point, producing technical and thought leadership content that elucidates technical solutions for developers and IT leadership. Today he heads Agile SEO, the leading marketing agency in the technology industry.
