$43 billion - That's how much the FBI estimates has been lost to Business Email Compromise (BEC) attacks between 2016 and 2021. What's more, the FBI states that BEC attacks are 64 times more destructive for businesses than ransomware attacks.
BEC attacks are the most expensive cyberattack businesses face today, and worryingly, they're on the rise. Today, more than 70% of organizations have experienced a BEC attack. However, many people are still unsure what exactly a Business Email Compromise attack is or how it works. To protect against these increasingly severe attacks, knowing what they look like and how they occur is essential. With this in mind, let's dive into everything you need to know about Business Email Compromise attacks.
Business Email Compromise (or BEC) is a type of scam, or more specifically, a phishing attack, where a bad actor targets a business to defraud the company. Typically, the attacker will try to trick an employee, often a senior executive or budget holder, into transferring funds or revealing sensitive information.
Businesses of any size can fall victim to a BEC attack, and BEC scams increasingly target small businesses. In other words, no company is safe.
While traditional phishing scams rely on general wording to trick a small percentage of the hundreds or potentially thousands of recipients, BEC attacks work differently.
In a BEC attack, the messaging is targeted directly at an individual or small group within an organization and tailored to encourage the recipient to take action. These emails are often persuasive because they appear to come from someone in authority or a trusted external partner. Usually, the attacker will impersonate a high-ranking person within the organization or partner company to further motivate the victim into carrying out the malicious request.
Attackers can impersonate trusted entities in multiple ways. This can include domain spoofing, lookalike domains, and through compromised accounts. With domain spoofing, the attacker fakes an email domain to fool users into believing the email comes from a trusted source. Alarmingly, around 3.1 billion domain spoofing emails are sent every day.
Similarly, lookalike domains take advantage of characters that people can easily confuse. For example, "netflix.com" (legitimate) vs. "netffix.com" (lookalike). These changes can be challenging to spot because our brains often see what we expect to see. By contrast, a compromised account is a legitimate account (that comes with specific privileges) that a threat actor has hijacked.
Hackers often follow many proven archetypes when crafting their malicious messages, including:
Business Email Compromise attacks are often hard to detect for many reasons. They're low in volume, so don't cause unusual spikes in email traffic that can alert security filters to an ongoing attack. Additionally, attackers use IP addresses with a neutral or good reputation when carrying out the attack. If the email comes from a legitimate account, detection is nearly impossible.
Authentication factors are simply a way of confirming your identity when you attempt to sign into an account. Multi-factor authentication (MFA) requires two or more types of authentication before access is granted. The three most common types of authentication factors are:
Typically, MFA systems will use a combination of these authentication factors to achieve a higher level of security.
The bottom line is, MFA makes it harder for cybercriminals to execute successful attacks. For example, suppose an attacker has managed to obtain an employee's username and password. Without MFA, the attacker can log in to that account from anywhere in the world and leverage those account privileges to request sensitive information or fund transfers from the appropriate department. But with MFA, things get more interesting. While the attacker may have login credentials, they're highly unlikely to have access to the employee's smartphone and won't have access to their biometrics. This means attackers stay locked out of corporate accounts.
Adequate cybersecurity training goes a long way to protecting against successful attacks. Employees should know the risks of these attacks and how to identify the telltale signs of a fraudulent email (a sense of urgency, unusual demands, a change in bank details). They should also be trained in who to contact and how to dispose of the attack email so that it can be taken care of properly.
Modern email security solutions leverage machine learning and artificial intelligence to identify attempts at account compromise, phishing, or luring high-level targets.
Attackers rely on creating a false sense of security by impersonating trusted entities. Still, they also try to develop a sense of urgency to encourage the victim to act quickly, so they don't have time to fact-check the details of the message. Therefore, make it standard operating procedure for workers to confirm requests for funds or data through secondary means, like a call or face-to-face meeting.
BEC attacks remain one of the most severe types of cyberattacks businesses face today, and yet, they're not as well-known as ransomware or other types of cybercrime. The key to avoiding this type of attack is deploying appropriate security controls, like MFA, and educating employees about the anatomy of BEC attacks.