Business Email Compromise: How to Protect Your Company

Business Email Compromise scams have cost organizations over $55 billion globally between 2013 and 2023. No business, large or small, is immune. In today’s SensCy Cyber Brief, your SensCy team investigates Business Email Compromise (BEC) fraud, exploring methods threat actors use that could leave your organization vulnerable. For a quick snapshot of recent trends, see Business Email Compromise (BEC) Incidents Up 200%.

What is Business Email Compromise?

Business Email Compromise, also known as Email Account Compromise (EAC), is arguably the most financially damaging online crime affecting organizations today. According to the FBI, BEC fraud cost businesses around $43 billion globally from June 2016 to December 2021, with $2.4 billion lost in 2021 alone. SensCy research indicates the frequency of BEC incidents will likely increase, largely due to remote work and higher email volumes, aligned with the broader increase in Business Email Compromise and why you need to protect your email.

How a BEC Attack Unfolds:
 Research ➔ Phishing ➔ Spoofing ➔ Financial Loss

How Criminals Execute BEC and EAC Scams

Criminals carrying out BEC scams often send emails appearing to come from trusted sources, making requests look legitimate. Examples include a vendor emailing an invoice with updated payment details or a CEO requesting the urgent purchase of gift cards.

Email Spoofing and Lookalike Domains

  • Slight variations in email addresses (e.g., changing a letter or using a similar domain)
  • Convincing employees that emails are legitimate

Spear Phishing and Social Engineering

  • Using personal or professional details to craft targeted, convincing messages
  • Leveraging public information (such as social media or company websites)

Malware and Credential Harvesting

  • Deploying malware through email attachments or links
  • Gathering sensitive login credentials or financial data

Real-World Examples of Business Email Compromise

  • Vendor Email Scam: In 2023, a U.S. manufacturing firm lost $2.5 million after paying a fraudulent invoice sent from a spoofed vendor email.
  • CEO Fraud Attack: A CFO wired $480,000 in response to an urgent spoofed email seemingly from the CEO.

CEO impersonation accounted for 50% of BEC scams reported in 2023.

Reporting a BEC Scam

If your organization falls victim to BEC:

  1. Contact your bank immediately to request a recall of the fraudulent wire transfer.
  2. Report to the FBI’s IC3 portal: Visit ic3.gov to formally report the crime.
  3. Notify internal teams: Inform your cybersecurity, finance, and legal departments promptly.
  4. Contact cyber insurance providers, if covered, to begin claim procedures.

How to Build a Response Plan for BEC Incidents

Being prepared can significantly minimize damage from BEC scams. SensCy recommends:

Immediate Actions

  • Create and regularly update emergency contact lists.
  • Implement “pause and verify” policies for wire transfers.

Team Involvement

  • Clearly define incident response roles for IT, Finance, Legal, and Executives.

Communication Plan

  • Develop pre-written crisis messages for employees, clients, and suppliers.

Drill Exercises

  • Conduct quarterly simulated BEC incident drills.

How to Protect Your Business Against BEC

Proactive measures can greatly reduce BEC risks:

Employee Awareness and Training

  • Conduct regular phishing awareness training sessions.
  • Train employees specifically on CEO fraud attack recognition.
  • Include high-frequency bait scenarios, such as invoice fraud and DocuSign phishing emails, so employees can recognise “trusted brand” impersonation patterns.

Implementing Business Email Security Tools

  • Deploy email authentication protocols like DMARC, DKIM, and SPF.
  • Use advanced email security software to detect threats proactively.

Financial Verification Policies and Processes

  • Always confirm payment details through direct verbal communication.
  • Require dual approvals for significant financial transactions.

Conclusion: Prioritize Cybersecurity to Prevent BEC Losses

BEC scams aren’t just a cybersecurity issue; they’re a matter of business survival. Strengthen your organization’s defenses today with SensCy’s comprehensive cybersecurity training and BEC protection strategies. 

For more information and assistance, contact us to learn more.