By this point many of us know what phishing is. It’s the act of pretending to be from an authentic source to try and scam personal details, money or data from victims.
Phishing itself is still one of the most prevalent forms of cyber-crime out there. One particular form of phishing that’s currently on the rise, is business email compromise (BEC). The Central Statistics Office recently reported that a staggering 75% of businesses worldwide, experienced some form of BEC. This makes it one of the most common tactics for business fraud.
In this blog, we’re going to explore what BEC is, look at how it can affect your business and discover how you can keep your data safe from BEC cyber criminals.
What is business email compromise?
Business email compromise is a form of phishing that carefully and deliberately targets high up individuals within an organisation or business. These individuals include: senior executives, budget managers, facilities managers and even as high up as c-suite professionals like CEOs and CFOs.
Just like regular phishing emails, BEC messages will pretend to be from employees at a business. They will often attempt to convince targets to release funds or sensitive data which can then be sold on. What sets BEC phishing emails apart from regular phishing emails, is that these emails are often of a higher quality than their regular counterparts.
BEC emails will be highly crafted to a specific individual, frequently using the same tactics as Account-based marketers, to find out public information about the reader and using that to their advantage. Many are actually moving away from just email to chat software like Slack, Microsoft Teams and more, in an attempt to seem like they are coming from within the organisation itself.
You can find out more about business email compromise on the government’s NCSC website.
Why is BEC dangerous?
There are three key ways BEC can cause serious damage to an organisation.
Financial fraud
If a BEC scheme is successful, it can see senior professionals directly send funds to a scammer who is pretending to be an employee. In worst case scenarios, it can even see them sending entire bank account details which are often promptly emptied.
Data breaches
BEC scammers may also request sensitive information, either about the business, its customers or its employees. The scammers will either sell this information to unscrupulous parties, or can use it to directly blackmail victims.
Malware
BEC communications may often include links to dodgy websites, which will be packed with malware and viruses. One of the worst examples of these is ransomware, which could lock down your network and data and then demand a payment for everything to be released.
How can I stay safe from BEC?
Many of the same rules for staying safe from phishing apply here too – because BEC is a form of phishing itself. However, since BEC emails will often be tailored to their exact recipient, you’ll need to be extra vigilant. Here’s how:
Always confirm any budget or data requests
If you get a budget or data request that you aren’t expecting, firstly email the sender on their regular email address, or better yet, on another form of communication, like a quick phone call. Second, check in with another member of their team to confirm the money or data is needed.
Enable two-factor authentication on your employees’ email accounts
Many BEC emails will come from a hacked employee email account – which makes them extra hard to spot. Enabling two-factor authentication, or multi-factor authentication, is a great way to protect your employees’ accounts from being breached in the first place.
Create a domain for your company emails
Create a domain name for all of your company email accounts, and avoid using any free providers like Gmail or Hotmail. This ensures that BEC attackers won’t be able to mask their scamming attempt behind any easily imitable email account that they can create online.
To find out more about how we can help you prepare yourself against BEC, contact Team CSP here.