Cybercriminals continue to become more sophisticated, leveraging a wide range of tactics in order to attack their targets. One tactic that has increased in frequency, complexity and resulting losses over the past few years is the use of business email compromise (BEC) scams.
A BEC scam entails a cybercriminal impersonating a seemingly legitimate source—such as a senior-level employee, supplier, vendor, business partner or other company—via email. The cybercriminal uses these emails to gain the target’s trust, tricking them into believing they are communicating with a genuine sender. From there, the cybercriminal convinces their target to wire money, share sensitive information or engage in other compromising activities.
BEC scams can lead to numerous consequences for both you and your employer, including account exploitation, stolen data and lasting financial hardship. As such, it’s crucial to understand these scams and how to mitigate them. This article outlines common BEC tactics, highlights red flags to watch for and explains what to do when you come across a suspected scam.
Common Business Email Compromise Tactics
BEC scams involve cybercriminals impersonating individuals or entities within their targets’ trusted networks for malicious gain. These scams are categorized as a form of social engineering. This broader cyberattack method preys on key human behaviors (e.g., trust in authority, fear of conflict and the promise of rewards) to obtain unwarranted access to corporate systems, funds or data.
According to the FBI, there are several different types of BEC tactics, including:
- False invoice scheme—With this tactic, a cybercriminal impersonates a company supplier to trick their target into transferring funds to a phony account.
- CEO fraud—This tactic entails a cybercriminal impersonating a senior-level employee or executive and requesting that their target conduct a wire transfer to a fake account. The request often threatens the target with work-related consequences or other punishments for failing to comply.
- Account compromise—Through this tactic, a cybercriminal hacks into an employee or executive’s actual email account and sends messages to various contacts, attempting to fool these recipients into sharing corporate data or paying fraudulent invoices.
- Attorney impersonation—This tactic refers to a cybercriminal impersonating a lawyer or other legal representative and requesting a payment be made to a phony account in order to handle a corporate matter deemed “sensitive” or “pressing.”
- Data theft—With this tactic, a cybercriminal impersonates a HR professional to trick their target into sharing private information about employees or executives. The cybercriminal can then leverage this data during future attacks.
Red Flags to Watch for
Even though BEC scams can be convincing, there are some red flags you can watch for:
- Messages that lack personalization; contain awkward phrasing; or have glaring spelling, formatting or grammatical errors (though scams powered by artificial intelligence tools may appear polished and error-free).
- Mismatched domains or reply-to addresses, especially those that closely mirror a genuine website or account, with the exception of a single character (e.g., janedoe@samplecompanyy.com versus janedoe@samplecompany.com).
- Unusual requests from known or otherwise trusted contacts, particularly those that push you to act fast, click on suspicious links or attachments, bypass company protocols, or keep the interaction a secret.
Handling a Suspected Business Email Compromise Scam
If you receive an unusual message and suspect a BEC scam, take these steps:
- Don’t interact. Refrain from immediately responding to the message, fulfilling any requests, or opening embedded links or attachments.
- Follow verification protocols. Never, under any circumstance, bypass your employers’ verification requirements for sharing sensitive data, paying invoices or otherwise transferring corporate funds. These requests should be carefully analyzed and discussed with multiple parties—such as management, HR and accounting professionals, and the supposed sender—either in person or over the phone to confirm their validity, especially if they involve alternative payment procedures.
- Report it. When you are unable to verify a message or related request, report it immediately. This may entail forwarding it to designated IT staff or using a built-in email alert system to flag it for further review.
- Delete it. Once the message has been properly reported and investigated, be sure to remove it from your inbox (including the trash or spam folders).
We Can Help
BEC scams are a growing threat, but staying informed is your best defense. By recognizing common tactics, watching for red flags and following proper verification protocols, you can help defend yourself, your employees and your business against costly breaches. When in doubt, verify before you act, and always report suspicious activity promptly.
While being prepared and understanding what to watch for when it comes to BEC scams, it’s also important to have proper insurance in place as an added layer of protection. If you’d like additional information and resources, we’re here to help you analyze your needs and make the right coverage decisions to protect your operations from unnecessary risk. You can download a free copy of our eBook, or if you’re ready to make Cyber Liability Insurance a part of your insurance portfolio, Request a Proposal or download our Cyber & Data Breach Insurance Application and we’ll get to work for you.