Union Bank® for Business

According to the Verizon 2019 Data Breach Investigations Report, 43% of data breaches affect small business. Due to their size, small businesses often do not have the resources to focus on cybersecurity. But they still handle large amounts of business and consumer data. This makes them a prime target for cybercriminals. If affected, a cybersecurity or data breach incident can put a company out of business.

We’d like to help you.

Business Email Compromise (BEC) is a sophisticated scam in which a cybercriminal sends an email that appears to come from a trusted source. In many types of BEC, the scammers uses fraudulent information to trick companies into misdirecting financial transactions into accounts that the scammers control.

BEC continues to trend as a key cyber threat plaguing businesses, accounting for $1.7 billion dollars in losses in 2019.  

The 2021 Treasury Fraud & Controls Survey found that 86% of respondents viewed BEC as the most dangerous threat facing their organizations through 2021 and 2022. Clearly, it is a serious problem for companies and will remain so for the foreseeable future.

BEC Tactics Are Tough to Detect
Cybercriminals perpetrate BEC scams using several tactics. They can hack victims’ inboxes and use them to send fraudulent requests for payments. They can forge an email so it appears to come from a legitimate sender (a technique also known as ‘spoofing’). Or they can create a fake email account that is a close facsimile of the legitimate one (e.g., “internal.suppport@example.com” instead of “internal.support@example.com”) and then send a request in hopes that the recipient isn’t paying close attention. Any of these variations can be tough for victims to detect.

BEC threats also leverage deception and patience. Users may not immediately notice that their account has been compromised, giving cybercriminals time to study the organization and embed themselves into an existing communications flow. They may, for instance, learn the nuances of the CFO’s or CEO’s communications (e.g., their communication style, how they sign their name), then imitate those details so their fraudulent messages appear even more legitimate.

The target of a BEC attack may receive an email that displays the sender’s real name, title, function, the team they work on, corporate branding and their actual (or a very similar) email address, making the message extremely convincing.

Types of BEC
There are three main types of BEC:

• Fake emails from the “CEO,” “CFO” or other senior executives are sent to victims asking for funds to be sent/wired to the criminal’s account
• Invoices for fake companies are created by criminals that are then sent to financial institutions for payment
• A trusted individual (coworker, boss, etc.) is impersonated by criminals who ask that the victim purchase gift cards (online or in-store) for a work event and send them to the cybercriminals

BEC techniques can also be used in conjunction with phishing attacks (malicious emails with the goal of tricking users into exposing sensitive information or interacting with malicious content like malware). A cybercriminal who hacks one user’s inbox may, for instance, exploit their access by sending phishing messages laced with malware to their victim’s contact lists.

Tips to Avoid BEC
So, what can companies and individuals who might be targets for BEC scams do to prevent them? Here are a few important tips to follow:

• If policies are in place, employees responsible for wire transfers need to follow these internal policies (e.g., the same person that submits a wire transfer should not be able to approve wire transfers, set dollar amount limits on them, and/or validate beneficiary changes)
• When receiving financial transaction/wire transfer instructions, employees should always validate (with a known source) the email address, dollar amount, recipients, etc.
• Employees should always verify that the funds’ destination and amount is in line with a customer’s usual activity
• Employees shouldn’t reply directly to the email sender regarding a wire transfer request; they should use email “forward” to avoid responding directly back to potential BEC perpetrators, or, better yet, pick up the phone and call their contact directly, as their email account may be compromised
• Employees should be wary of emails that are urgent and create pressure to expedite processing of a financial transaction
• Employees should reach out to a known contact to verify the email address of the sender if an email seems suspicious
• Employees shouldn’t click on anything in an unsolicited email or text message asking them to update or verify account information. They should look up the company’s phone number on their own (not using the one a potential scammer is providing) and call the company to ask if the request is legitimate.
• If anything seems suspicious, employees should alert their manager and/or bank immediately
• Employees should be alert for emails requesting that they purchase gift cards. As noted above, BEC fraudsters have been reported posing as management to pressure victims into purchasing gift cards, claiming they’re for a work-related event. They actually want to steal the cards, which are easy to transfer and, in many cases, impossible to trace.

Suspected BEC attempts should be reported immediately to your financial institution; you should also contact your local FBI field office to report the crime, and file a complaint with the FBI’s Internet Crime Complaint Center (IC3).

U.S Small Business Administration

Federal Trade Commission

National Institute of Standards and Technology

The National Cyber Security Alliance (NCSA)

U.S Department of Homeland Security