BEC: Another scammer in town

The business sector has undergone a significant transition in an era defined by digital communication and seamless connectivity. Organizations unknowingly expose themselves to a new generation of cyber risks as they continue to use technology to improve productivity and workflow. In recent years, Business Email Compromise (BEC) has emerged as one such sneaky threat as one of the cybercriminal’s tricks.

A huge threat to all businesses is this type of cybercrime that has been shown to steal up to billions of dollars and leave a financial and reputational trail in its wake.

We examine the realm of BEC and how you and your business can protect yourselves against yet another cyber threat we’re facing.

Understanding BEC

Business Email Compromise, often referred to as CEO Fraud, is a sophisticated cybercrime tactic where fraudsters impersonate high-ranking executives, employees, or trusted vendors to manipulate people within an organization into taking specific actions - often these actions involve transferring money, sharing sensitive information (both about employees, customers and business information), or other actions than ultimately compromise the organization’s finances or security.

BEC attacks come in various forms, but they can generally be categorized into three primary types:

• CEO fraud: In this scenario, cybercriminals impersonate a CEO or other top-level executives, instructing employees to initiate wire transfers, release confidential information, or undertake other financial actions.

• Fake Invoice: Fraudsters send invoices that appear legitimate but contain altered payment instructions. Here, they imitate a supplier or service provider which seems genuine. These payments might be processed by inattentive workers, who unintentionally transfer money to the cybercriminal’s accounts.

• Employee impersonation: Cybercriminals target lower-level employees, gaining access to their email accounts. They can furthermore use a domain that looks similar to the high-level employee - this often convinces employees to follow the instructions the hackers gives them.

Inside a cybercriminal’s head

The success of BEC attacks lies in the art of manipulation and psychological exploitation.

Cybercriminals put a lot of effort into researching their targets, often looking through social media platforms and company websites to gather information about key personnel, business relationships, and ongoing projects within the organization. Once they have gathered all the necessary information, they write the deceiving emails that ultimately fool the employees - the hackers thus exploit the trust and authority of the organization they attack.

If we take a closer look at the different tactics the hackers use, they give us a pretty good idea of their way of thinking. Some of their most used strategies and methods are:

• Spoofed domains: Hackers register domains closely resembling legitimate ones, making it difficult to distinguish between real and fake emails - this is also called typosquatting.

• Social engineering: Using personal details gathered from public sources, criminals can customize their e-mails to the specific target, thus making their requests appear more credible.

• Urgency and pressure: One of the social engineering tactics that hackers often use is to create a sense of urgency, compelling recipients to act quickly without thoroughly verifying instructions.

• E-mail interception: Here, hackers gain unauthorized access to e-mail accounts, allowing them to observe ongoing communications and craft more convincing phishing.

• Malware and attached files: When hackers send out phishing e-mails, they often attach malware hidden in either files or links. Once you click on those, malware is installed and compromises the software on your device - to steal information.

• Payment diversions: Cybercriminals can intercept communication between organizations and service providers - and thus alter the payment details so that the hacker gets the payment instead of the service provider.

Minimizing the threat of BEC

In order for us to keep up with the constantly evolving threat landscape we need to educate ourselves. Since hackers find new strategies, we need to learn about these strategies as well.

There is no absolute solutions to their hacking and strategies they use, but we can secure our technology and educate ourselves. When we’re vigilant, we can significantly minimize the threat BEC pose. So, below we have listed some of the best solutions you can implement to keep the hacker out of your systems:

Employee training and awareness

Inform staff members on a regular basis about the various types BEC attacks, which should then highlight the value of double-checking requests for private data or financial transactions. When you can recognize suspicious e-mail addresses, verify URLs, and question unusual requests, you are well on your way to better cybersecurity.

Multi-Factor Authentication (MFA)

Implement MFA across all critical systems and apps to add an extra layer of security. Even if a cybercriminal gains access to an employee's email, MFA can prevent unauthorized account access and make it a lot more difficult to hack into the systems.

Strict payment verification processes

For financial transactions - especially those involving fund transfers or changes to payment information - try implementing a robust verification procedure, so hackers can’t exploit potential vulnerabilities.

Domain verification

Use domain-based message authentication, reporting, and conformance (DMARC) to prevent domain spoofing and unauthorized use of company domains.

E-mail filters

There are many different tools you can add onto your e-mail software, which helps you navigate in junk mail, spam, and phishing. These tools will automatically detect and flag suspicious e-mails before they reach your inbox.

Management of providers

To make sure your payments are safe and end at the right provider, you can establish clear communication channels and protocols for validating payment requests or changes in payment details from vendors.

Regular software updates

Keep all software and systems up to date to prevent vulnerabilities that cybercriminals could exploit. They exploit holes in software and systems to enter your databases - and this is thus a perfect opportunity for them to steal and compromise your data.

Incident response plan

Develop a comprehensive incident response plan that outlines how you should react in case of a suspected or confirmed BEC attack. This plan should include communication protocols, containment strategies, and coordination with law enforcement if necessary.

Remember BEC

Business E-mail Compromise is an intimidating type of phishing that uses manipulation, trust and authority to achieve the hacker’s goals. As businesses continue to digitize their work and data - and furthermore expand their online presence - the risk of falling victim to BEC attacks increases.

However, organizations can establish a strong defense against BEC attacks by combining technology-driven defensive measures, continuing awareness training, and urging a culture of cybersecurity awareness. Organizations can strengthen their cyber defenses and reduce the financial and reputational risks that come with the constantly changing cyber threat. By uncovering the strategies utilized by hackers and putting preemptive measures in place, you stand stronger than the hackers.