Back

Understanding Business Email Compromise Fraud and How to Protect Your Business

In today’s digital world, email has become a crucial communication tool for businesses. It has also become a primary target for cybercriminals through a sophisticated scam known as Business Email Compromise (BEC).

What is Business Email Compromise (BEC) Fraud?
BEC is a type of cybercrime where attackers gain access to a business email account or create a convincing fake account to trick employees into transferring money or sharing sensitive information. These fraudsters often pose as high-level executives, trusted vendors, or clients, making their requests seem legitimate and urgent.

How Does BEC Fraud Work?
BEC fraud typically follows these steps:

1. Reconnaissance: The attacker researches the target company, identifying key personnel, such as executives, finance department members, and vendors.
2. Email Account Compromise: The attacker gains access to or creates a spoofed email address that closely resembles a legitimate one. They may hack into an actual email account or register a similar-looking domain.
3. Deceptive Communication: The attacker sends an email that appears to come from a trusted source, such as a company executive, vendor, or client. The email often requests an urgent wire transfer, payment, or sensitive information.
4. Execution: If the employee falls for the scam and follows through with the request, the attacker receives the money or information, often transferring the funds to overseas accounts.

• CEO Fraud: The attacker impersonates a high-ranking executive, such as the CEO or CFO, and requests an urgent wire transfer.
• Account Compromise: The attacker hacks into an employee’s email account and uses it to request payments or sensitive information.
• Fake Invoice Scam: The attacker impersonates a vendor and sends a fake invoice requesting payment.
• Attorney Impersonation: The attacker pretends to be a lawyer or legal representative and pressures the victim into making a quick payment.

• Verify requests. Always confirm requests for payments or sensitive information by contacting the requester via a known, trusted phone number or in person.
• Educate your employees. Regularly train your staff to recognize BEC scams and understand the importance of verifying requests.
• Implement strong security measures. Use multi-factor authentication (MFA) for email accounts, regularly update passwords, and monitor account activity for suspicious behavior.
• Establish a protocol for financial transactions. Create a standardized procedure for approving and verifying financial transactions, especially those involving wire transfers.

• Act quickly. If you suspect your business has been targeted by BEC fraud, contact your bank and local authorities immediately.
• Report the incident. Report the fraud to the FBI’s Internet Crime Complaint Center (IC3) and inform your clients and partners as necessary.
• Strengthen your defenses. After an incident, review and improve your security measures to prevent future attacks.

BEC fraud is a significant threat to companies of all sizes. By staying informed, educating your team, and implementing robust security practices, you can protect your business from becoming a victim of this costly scam. Remember, vigilance is your best defense.