The ABCs of BEC – Business Email Compromise

  • Business Banking, Fraud and Security
The ABCs of BEC Business Email Compromise scaled

The Impact of Business Email Compromise

$125,600

The Average Amount a Company Loses to a Business Email Compromise (BEC) Attack

Business Email Compromise (BEC) is one of the most financially damaging online crimes. With losses topping more than $2.7 billion last year and a year-over-year increase in attacks of 14.5%, BEC is a significant threat.

What Is BEC?

In a BEC scam, criminals send an email message that appears to come from a known source making a legitimate request, like these examples:

  • A vendor your company regularly deals with sends an invoice with an updated mailing address or account information.
  • A company CEO asks her assistant to purchase dozens of gift cards to send out as employee rewards. She asks for the serial numbers so she can email them out right away.
  • A homebuyer receives a message from his title company with instructions on how to wire his down payment.

Versions of these scenarios happened to real victims. All the messages were fake. And in each case, thousands—or even hundreds of thousands—of dollars were sent to criminals instead.

How BEC Works

In this graphic – provided by the Federal Bureau of Investigation (FBI) – a BEC attack is conducted through careful research to identify targets, groom company representatives, make the request, and finally, secure a fraudulent payment.

Courtesy of the Federal Bureau of Investigation

Examples of some of the more damaging BEC attacks can be found here.

The ABC’s of Avoiding BEC Scams

Scammers do their homework to make their communications sound believable. They may research company executives’ social media accounts and reference company posts to make their demands sound more realistic.

But in most cases, breaking up a BEC attack is as simple as picking up the phone to verify instructions or reading between the lines to see if an email really “sounds like” the person you know. BEC attacks are preventable. The ABCs below provide a good start for minimizing your company’s risk.

A – Avoid

  • Do not use free web-based email accounts or personal email accounts for Business.
    Don’t use free web-based accounts for business or get in the habit of using personal email accounts to send business emails. Stick to your corporate email account, which should have more stringent security protocols.
  • Avoid replying to emails – use FORWARD instead.
    Forwarding an email requires you to manually type the address or select a known, trusted email address from a list. This eliminates a habit BEC attackers depend on to pull off their scams.

B – Be Proactive

  • Implement multi-factor authentication for your business email.
    MFA makes it much more difficult for cybercriminals to even gain access to an email account that could be used to commit fraud.
  • Secure your company domain.
    BEC attacks often use spoofed domains. Registering domain names similar to your company’s will prevent the email spoofing at the heart of many successful BEC attacks.

C – Check and Double-Check

  • Know your customers, fellow employees, and vendors.
    If something seems off, it probably is. Did a trusted vendor you talked to just last week suddenly email you to say they’re moved and to send checks to a new location?
  • Make the call.
    Don’t email, pick up the phone and call your customer, co-worker, or vendor to verify any unusual requests. Use a known phone number (not one from an email) to verify that a request is legit.

As is the case with most cybercrimes, it’s much easier to prevent a BEC attack than to recover from one. In addition to the financial loss, victims of a BEC attack can end up tied up in lawsuits with customers, vendors, and insurers for years. The cost in time, resources, and reputation warrants taking a few extra seconds to follow the ABCs and keep your business safe.

More Resources

  • Fraud and Security

Can You Spot a Phishing Scam?

October is Cybersecurity Awareness Month. Every day, thousands of people fall victim to fraudulent emails, texts and calls from scammers pretending to be their bank....

  • Business Banking, Leadership, News

GRB President and CEO Phil Pecora Talks Inflation and Interest Rates in 2024

We’re proud to have GRB President and CEO Philip L. Pecora interviewed in the Rochester Business Journal about cooling inflation and the potential for a...

  • Fraud and Security

Know the Signs of Bank Text Message Spoofing

Bank spoofing via text is a deceptive tactic employed by cybercriminals to trick individuals into divulging sensitive financial information or executing fraudulent transactions. These spoofing...

View All Resources

Related Posts