Business Email Compromise: Everything You Need To Know (FAQs)
How Do Business Email Compromise Attacks Work?
BEC attacks use an authentic and trusted brand to trick victims into sharing sensitive details and information. They rely on accurate and authentic impersonation to make their requests seem more valid. For example, a user will be more likely to share financial details with a brand they already know and trust, than with someone unknown to them.
To make the attacks seem more legitimate, attackers will often try to gain access to an authentic inbox. This means that they are able to send email from a real email address, with the correct header, footer, and DKIM details. This reduces the amount of work they have to do in order to appear legitimate. It is for this reason that it is important for organizations to monitor the emails that are being sent from their inboxes as well as inbound messages.
Malicious actors are able to gain access to inboxes in a variety of ways. This includes using stolen credentials purchased on the dark web, previous phishing or social engineering attacks, and brute force attacks. So, the first thing you should do to prevent BEC attacks is keep your credentials safe. Some of the platforms features on this list are designed for this purpose.
Once they have gained access, an attacker will reach out from the compromised account to existing employees or to other companies. As they are writing from a valid email address, there is very little to raise the victims’ suspicions. The attacker may send a fake invoice, request access to data, or even attempt to hijack another account.
With the amount of information readily available online – think of all the information you share on LinkedIn – coupled with the valid account and ability to look back at previous conversations and imitate style, BEC can be a very effective and dangerous attack type.
To prevent BEC attacks, it is worth keeping an open mind about what to look for. With attackers constantly searching for new ways to trick you, is no checklist (or limit) to how they might try to fool you. Another area that could be worth investing in is Security Awareness Training (SAT) – this educates your users on suspicious behavior and explains best practice responses.
How Does Business Email Compromise Work?
BEC attacks exploit the weakness of emails to target top-level people within an organization. Often BEC starts with a phishing attack which allows cyber-criminals to gain access to an important email account within an organization. For example, someone in the finance department, or the company CFO or CEO. Once attackers have access to this account, they can then send out emails that appear to be legitimate, asking for wire payments to be made from others in the organization, or across their supply chain. These emails won’t be flagged as malicious by any anti-virus or basic email filtering technologies, and most users probably won’t expect their boss or a trusted contact to be compromised, making this a particularly harmful kind of attack.
Another method cyber-criminals can use is simply spoofing the domains of high-level business email accounts. For example, the attacker will see the email address [email protected] and use [email protected] instead. This is known as Lookalike Domain Spoofing. The similarity of the email addresses may be enough to fool suspecting users into believing it’s the real contact that has emailed them, which could convince them to make a payment.
This type of BEC attack is less sophisticated than full account compromise, but it is much more common. It’s also much more likely to be stopped by email security technologies, as they can detect when a domain has been spoofed. However, it can still very successful in convincing unsuspecting users.
Lookalike domain spoofing is commonly used to impersonate brands, such as Microsoft or Apple. Attackers copy these brand domains to try and in convince users to enter passwords, or make payments.
What are the Different Kinds of Business Email Compromise?
We’ve broadly covered two methods in which attackers can carry out Business Email Compromise attacks, but the FBI has identified 5 unique variants of BEC. Here’s a brief rundown of what each involve:
CEO Fraud: Attackers impersonate a CEO, or a high-level executive, and target employees with requests for payments.
Account Compromise: An employee’s email account is compromised, and attackers use their contacts to request payments to their own accounts.
Bogus Invoice Schemes: Attackers will impersonate suppliers of foreign companies, in order to request fraudulent fund transfers and payments.
Data Theft: Employees in HR and admin departments are compromised so that attackers can gain access to sensitive company and customer information.
Attorney Impersonation: Attackers impersonate lawyers or solicitors to find out confidential business events. This is sophisticated type of account compromise attack, and much less common.
Why Are Business Email Compromise Attacks Becoming More Common?
Most industry analysts agree that BEC attacks are becoming more common because they are low risk for attackers, can be relatively low cost to pull off, and they are often very successful.
Rather than needing to spend time developing malware, or trying to gain access to systems, Business Email Compromise allows cyber criminals to very quickly get access to accounts and send out emails asking for payments. With just one compromised account, cyber criminals can send out hundreds of fraudulent emails, with a pretty good chance that at least one will be opened or replied to.
For high profile targets, cyber criminals may not even need to collect information for account compromise attacks themselves. High level employee email credentials are commonly bought and sold on the dark web. Research from LastLine tells us that CEO, CFO and executive account details fetch a high price, but attackers can make a profit of thousands by successfully mounting a business email compromise scam.
Why is Business Email Compromise So Dangerous?
Traditional approaches to email security rely on detecting threats. This could be a malicious domain that’s been known to send out spam emails. Or, it could be an attachment that contains malware, or a URL that leads to a harmful website. Email security technologies can identify threats based on patterns or signatures and stop those emails from being delivered to your users.
However, BEC attacks don’t involve any malware or harmful content being sent. These emails come from legitimate domains and will appear to most email security technologies to be completely innocuous. This means that the email has a high chance of being delivered to your users’ inboxes.
Because they target the human factor within the organization to succeed, once in the email inbox BEC attacks have a good chance at tricking employees into believing they are real. As we’ve covered, BEC attacks often target company executives, like CEOs or CFOs, or employees that work within company finances. When an invoice arrives from an employee like this, people usually trust that it is legitimate, and may go ahead and make the payment without caching the legitimacy of the email.
In addition, attackers are spending more time to develop BEC, spending more time investigating which individuals within an organization are likely to have authority in asking for invoices to be paid.
Considering these factors, it’s no surprise that Business Email Compromise is growing more common and becoming more harmful to organizations. There have been numerous examples of high profile BEC attacks, against organizations of all sizes.
The US Treasury found that the number of business email compromise attacks reported nearly doubled from 2016 to 2018, with nearly 1100 attacks reported every single month. The costs associated also continue to grow, now costing US companies an average of $301 million every single month, according to a Treasury Department Analysis.
How To Choose A BEC Protection Solution?
When choosing a BEC solution, it’s important to make the right choice for your organization. As no two organizations are identical, it’s important that you take the time to find a solution that matches your needs and addresses your vulnerabilities.
Selecting a solution that doesn’t fit your organization’s profile could leave you with a false sense of security. For instance, your business may release a large quantity of emails and other communications; this could make your brand susceptible to spoofing. Alternatively, you may have a large, disparate work force, the sheer number of employees makes you susceptible to phishing attempts. When selecting a BEC solution, you should consider for the following areas with regard to your own organization:
What Are Your Vulnerabilities?
If you are looking for a solution that can respond to email based threats, it may not be suited to cover SMS or Vishing attacks.
Before deciding what solution is best, look at where you are weakest.
Automation And Configuration
The ability to automate and configure your solution can affect how useful it is to your organization. It may be that you want a solution that you can let run in the background, without any need for input. Equally, you may want a more hands on solution that puts you in control of configuration and management. This decision will be based on your weaknesses, as well as your organizational resource.
What Are Its Features?
When choosing a BEC solution it’s critical to compare the features of each solution to ensure it will work in your environment. URL rewriting, always on connectivity, and database cross-checking gives you the best chance of remediating threats.
What Features Should You Look For When Selecting A BEC Protection Solution?
As indicated in the previous section, ensuring that your platform has the right features to address the issues that you face is imperative. This can be an overwhelming and confusing area to navigate. Nevertheless, it is one of the most important decisions you face in securing your organization from cyber threats.
- Customization – To ensure that your platform can protect your organization from the unique threats that it faces, your platform should deliver a good deal of customization. This ensures that you can reduce and eliminate any vulnerabilities.
- Domain Authentication – To corroborate if your email messaging is legitimate, you should ensure that your platform delivers DKIM/SPF features.
- Phishing Detection – By identifying and removing phishing mail, you are able to reduce the number of emails that may trick users.
- Employee Training – Good platforms will offer employees training and education to help them identify risk factors and signs of danger.
- Policy Management – Your solution should allow you to create policies and deploy them across all accounts easily.
- User Friendly Interface – Every tool that you use should be straightforward to use and easy to manage, allowing you to make the changes that you need to.
