Business email compromise (BEC) is a type of phishing scheme in which an attacker impersonates a high-level executive and attempts to trick an employee or customer into transferring money or sensitive data. This crime is particularly stealthy because it employs social engineering techniques to manipulate users.

BEC is on the rise — and it’s often difficult to prevent because it’s so targeted. So, what do you need to watch out for?

A Sneaky Social Engineering Scam

According to the FBI’s 2017 Internet Crime Report, BEC and email account compromise (EAC) represented the highest reported losses — costing 15,690 victims more than $676 million. BEC often subverts detection because the transaction appears legitimate from the company’s perspective. Confirmation calls and other authentication mechanisms also do typically reach the employee who submitted the legitimate request, making BEC even trickier to identify.

Read the white paper: Adapt to new phishing threats and assess websites automatically

The victims of BEC scams range from small businesses to large corporations, according to a public service announcement (PSA) from the FBI. Victims also come from a variety of industries, with no one sector appearing to be a favored target. BEC is a profitable crime due to the nature of the targeted attacks.

“The subjects monitor and study their selected victims using social engineering techniques prior to initiating the BEC scams,” wrote the FBI in the PSA.

Tripwire reported that criminals do a lot of homework — and seek a variety of information — when targeting a victim, including:

  • General information about the company (i.e., where it does business and with whom)
  • Names and titles of company officers
  • Management organizational structure
  • Information about new rounds of funding
  • Information about new products, services and patents
  • Product or geographic expansion plans
  • Travel plans

Common Characteristics of BEC Attacks

According to the Internet Crime Complaint Center (IC3), BEC complaints share some common characteristics. Businesses that use open source email services are frequently targeted, for example, as are employees who handle wire transfers.

The scenario often plays out like this: An email arrives that appears to be from a high-level executive within the company — or even a business partner or company attorney. Since the email address has been spoofed, it appears to be legitimate. A request for a wire transfer is included in the email, which urges the recipient to take immediate action.

The fraudulent email might claim, for example, that a supplier requires prompt payment for a service rendered. IC3 reported multiple instances of fraudsters impersonating lawyers and reaching out to potential victims to handle supposedly confidential or time-sensitive matters.

Keep in mind: Requests for money might ultimately come via a phone call. While BEC is initiated over email, criminals can use various modes of communication to complete the fraud.

Awareness Is the Key to Battling BEC

To keep these threats at bay, security leaders should implement a comprehensive awareness program for employees that spells out the details of BEC and how to recognize potentially malicious emails. The program should train users to identify suspicious requests and cross-reference the sender’s email with the corresponding executive’s known address. Most importantly, employees should not reply to risky emails under any circumstances.

Another best practice is to set up an email gateway to flag keywords like “payment,” “urgent,” “sensitive” and “secret” — all of which are common in fraudulent emails. Companies should also register as many domains as possible that are slightly different from the legitimate company domain to minimize the risk of email spoofing. Company leaders should avoid using free, web-based email services. Instead, they should establish a company domain name and use it to create official company email accounts.

Also, security leaders should coach employees to be mindful of what they post on social media. Cybercriminals can appropriate seemingly benign information, such as birth dates, favorite foods and places of residence, to personalize their social engineering schemes.

Finally, human resources (HR) teams should be aware that any job information posted on a company website can be used to facilitate targeting phishing scams, especially job descriptions, organizational charts and out-of-office details.

Listen to the podcast: Social Engineering 101 — How to Hack a Human

More from Fraud Protection

Remote access detection in 2023: Unmasking invisible fraud

3 min read - In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud. Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat. Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis. A rising threat As Fraud detection methods become more and…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

What to do about the rise of financial fraud

6 min read - As our lives become increasingly digital, threat actors gain even more avenues of attack. With the average person spending about 400 minutes online, many scammers enjoy a heyday. Old impersonation scams continue to deceive people every day, as con artists and hackers are armed with advanced technologies and sophisticated social engineering tactics. According to the Federal Trade Commission, financial fraud increased by over 30% from 2021 to 2022, with total losses surpassing $8.8 billion. This ever-evolving threat will continue to…