What Is a Business Email Compromise Attack?

Business Email Compromise (BEC) attacks are one of the most common types of cybercrimes in Canada and can result in devastating financial losses for businesses, reputational damage and legal repercussions. In this blog post, we’ll outline the different types of BEC threats and share how to defend against these scams.  
 
What is BEC? 
 
BEC, an acronym that stands for business email compromise, is a cybercrime whereby scammers assume the digital identity of a trusted persona to trick employees or customers into taking a desired action, such as making a payment or purchase, sharing data, or divulging sensitive information. Executives, finance employees, HR managers and new or entry-level employees are often targeted. 

62% of Canadian organizations reported an attempted BEC attack last year. -Proofpoint  

BEC attacks rely heavily on social engineering techniques, along with weak authentication credentials. As a result, these attacks are difficult to detect or prevent with traditional security tools or spam filtering. 
 
Examples of BEC Attacks 
 
Invoice scams: Attackers compromise a supplier’s or vendor’s email account and send altered invoices or payment instructions to customers. The altered details direct payments to the attacker’s account, resulting in payments being diverted away from the legitimate vendor. 

Employee Payroll Manipulation: Attackers pose as HR personnel and request changes to an employee’s direct deposit information. As a result, the employee’s salary is redirected to the attacker’s account. 

Tax Fraud: Attackers target HR departments during tax season, sending emails from the compromised company executive’s account requesting tax forms or other sensitive employee information. 

Admin Account Takeover: Attackers compromise the IT administrator’s account, who has full administrative access to the company’s Microsoft 365 account. They then are able to read and manipulate the emails of any other employee in the company and create more administrative users in order to maintain access. 

How to Combat BEC Attacks?  

A multi-layered approach is necessary to protect your business against BEC attacks. Here’s a list of useful tips for defending against BEC attacks: 

• Authentication 
• Verify via telephone any requests to payment changes 
• If your computer or applications are behaving unusually, report to your IT team to investigate
• Don’t enter any sensitive or personal information on a webpage you visited by clicking a link in an email
• Carefully examine email addresses, URLs and spelling used in any email correspondence
• Don’t click on links or open attachments in unsolicited mails, especially if it’s asking you to update or verify account information, or if the sender is pressing you to act quickly

By partnering with us, you get access to a team of dedicated security experts who are working 24/7 to catch and contain BEC attacks and security services, like Extended Detection and Response to help identify and prevent BEC attacks. If you’re concerned about your business security solutions, reach out to us to learn more about our security solutions.