iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Businesses rely heavily on email communication for various operations, and while it has undoubtedly streamlined communication, it has also given rise to a growing threat: business email compromise.
Business email compromise (BEC) attacks involve cyber criminals impersonating legitimate business contacts to deceive employees into transferring money or sensitive information.
Here are three crucial things you need to know about BEC to protect your organisation.
1. The anatomy of a BEC attack
BEC attacks are well-crafted and highly deceptive. Cyber criminals often start by researching their target organisations and gathering information about key personnel, business relationships, and ongoing transactions. Once armed with this information, they impersonate executives, suppliers, or trusted partners through email. These fraudulent emails are meticulously designed to mimic the sender’s writing style and use spoofed email addresses that closely resemble legitimate ones.
The attacker typically requests urgent actions, such as wire transfers, invoice payments, or confidential data sharing. Employees, believing they are communicating with a trusted source, may unknowingly comply with these requests, leading to significant financial losses or data breaches.
2. The growing prevalence of BEC
BEC attacks have seen a meteoric rise in recent years, making them one of the most pressing cyber security threats for businesses of all sizes. According to the FBI’s Internet Crime Complaint Center (IC3), BEC incidents resulted in losses exceeding US$1.8 billion in 2020, making it one of the costliest cyber crimes. These attacks target a wide range of industries, from finance and healthcare to manufacturing and technology, highlighting their indiscriminate nature.
The pandemic further exacerbated the BEC threat as remote work increased reliance on email communication. Cyber criminals exploited the uncertainty and disruption caused by COVID-19, making employees more susceptible to phishing emails and fraudulent requests.
3. Prevention and mitigation strategies
To defend against BEC attacks, organisations must implement robust prevention and mitigation strategies:
a. Employee training: The first line of defence is educating employees about BEC risks. Regular training programs can help employees recognise suspicious emails and understand the importance of verifying requests for sensitive actions.
b. Multi-factor authentication (MFA): Enabling MFA for email accounts can significantly reduce the risk of unauthorised access. Even if an attacker obtains login credentials, they won’t be able to access the account without the second authentication factor.
c. Email Authentication Protocols: Implement email authentication protocols like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) to verify email sender authenticity and prevent spoofed emails from reaching inboxes.
d. Verification of high-risk transactions: Implement strict verification processes for high-risk transactions, such as wire transfers or sensitive data sharing. Require multiple levels of approval and confirm requests through alternative communication channels before proceeding.
Business email compromise is a persistent and evolving threat that poses significant financial and reputational risks to organisations. Understanding the anatomy of BEC attacks, recognising their growing prevalence, and implementing robust prevention and mitigation strategies are crucial steps in safeguarding your business from this threat.
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
