Business Email Compromise is super tricky for your users and security solutions to spot... Here's what you need to know.
What is BEC?
Business Email Compromise, or 'BEC', is a form of phishing /spear phishing attack where a criminal attempts to trick someone into sending money or divulging sensitive information. Unlike standard phishing emails that are sent out indiscriminately to millions of people, BEC attacks are crafted to appeal to specific individuals.
"There's a phish out there for everyone."
BEC in numbers...
77% of organisations faced business email compromise (BEC) attacks in 2021 - up 18% on the previous year - with UK based organisations being heavily targeted. . Source: Proofpoint.
Over 6,000 businesses are targeted with BEC attacks each month. UK Finance recorded over 122,000 instances of this scam in 2019, which cost UK businesses gross losses of £455.8 million Source: Egress.
The FBI reported nearly $2.4 billion in victim loss to BEC scams in 2021, which is 49x as much as the losses from ransomware (as reported to the FBI - $49.2 million), but more than a third of the total cost of cybercrime ($6.9 billion). Source: FBI Internet Crime Report 2021.
How does a BEC attack happen?
BEC attacks capitalise on human pyschology, using social engineering techniques rather than a malicious payload such as a dangerous link or attachment.
Often, impostors will pose as a manager or member of the c-suite to email potential victims with an 'urgent' request. This usually involves sending money via wire transfer, which is difficult to trace and recover.
What to expect when you're expecting... BEC.
Here are some of the most common signs that you're being scammed:
1. Bizarre requests from senior leaders: Many people reply quickly to an email that's come from a manager or member of the c-suite. The boss is messaging - quick, I need to go back! However, it's important to take the time to consider their request... Does it seem odd? If they're asking you to transfer money or provide confidential information, treat the email with caution.
2. Attempts to sidestep normal channels: Your business likely has a system for processing all payments, regardless of their urgency. Imposters will try to bypass this step. For example, if they're asking for money, they may claim that it needs to be wired over immediately. We heard a real-world example recently from a customer where a BEC attempt sent an email asking them to message over WhatsApp. The target was then asked to get the company credit card and buy a load of gift vouchers and send over the codes - stat!
3. Confidentiality requests: Emails of this nature are often designed to try incite panic. As such, recipients may not take the time to verify the request. However, if the sender is specifically asking you to keep these messages to yourself and only communicate via a certain method, you're probably being scammed.
4. Huh? This doesn't sound like them: Take a close look at the main body of the email. Does it sound like it's come from the alleged sender? For example, it may be in broken English, despite the sender being a native speaker (we'll cover this more in one of the sections below!). Or, they usually greet me with 'Hey' not 'Greetings'.
5. 'Reply To' addresses that don't match the sender address: The impostor's 'Reply to' email address may not be the same as the one it's come from. Sometimes this is hard to spot because they regularly use lookalike domains to fool recipients. e.g an extra character Spearshielld.co.uk instead of Spearshield.co.uk or c0mpany.co.uk instead of company.co.uk.
Why do security solutions struggle to detect BEC?
If someone in your supply chain has experienced business email compromise and the imposter is using their email account to message you with an urgent request... Your Secure Email Gateway and Anti-Virus will 1. recognise the history between what normally is a trusted sender and 2. scan for links and/or attachments. If there isn't any because they're requesting for i.e a payment to be made. It goes undetected and responsibility falls to your 8th security layer - the user.
How are language model tools and AI changing the game for cyber criminals?
Instead of answering this one ourselves, we thought we'd ask ChatGPT for it's response.
Real-world Examples
Source: Sophos article: Artificial intelligence now a match for natural ignorance
Here is a lure from a BEC scammer trying to redirect someone's paycheque to the attacker's account. On the top is the original handwritten lure from the attacker, on the bottom is one Sophos asked ChatGPT to write:
Another example... Top message again is from a real scammer, the bottom from ChatGPT:
Are these perfect? No. Are these enough? Probably.
It's time to reset our expectations with traditional end-user awareness training
Let's take a look at the main areas we preach during end-user awareness training and how that would be able to help a user (providing they remember) be able to spot and mitigate the risk of falling victim to a BEC attack...
"Have you checked if there is a dodgy link?"
So, what can we do? Cyber criminals are forever changing their approaches... it's time we do too!
Introducing the Integrated Cloud Email Security (ICES) layer. The term was first coined in the Gartner 2021 Market Guide for Email Security. ICES solutions were introduced as a new category, and positioned as the best defence against the dark arts advanced phishing threats that evade traditional email controls.
You may be thinking... Shouldn't my Secure Email Gateway do that? While a SEG might be able to detect known threats, an ICES solution takes this to the next level. SEGS can scan links and attachments for malware, but an ICES email security solution uses a variety of advanced detection techniques, including *Natural Language Processing (NLP), **Machine learning, Social Graph Analysis (patterns of email communication), and image recognition.
Findings in IBM's Cost of a Breach Report showed that organisations with AI-based security solutions — such as ICES — experienced a significant reduction in data breach costs, cutting breach costs from $6.71m to $2.90m.
*Machine learning
**Natural Language Processing
It's saved our bacon!
If you'd like to learn how an ICES layer was able to help save our users from falling victim a BEC attack - you can where we've broken down a full timeline of the attack.
Alternatively, speak with the team about our free email security assessment and learn if your organisation would benefit from the extra visibility and enhanced email SecOps that an ICES layer provides and the benefit it can have for your users.
Interested to learn how Spear Shield and their customers are able to spot sophisticated phishing attacks that are able to slip through the net?
Spear Shield are currently running a FREE Email security assessment that can help you identify:
- Total number of Dangerous and Suspicious emails detected landing into employees inboxes throughout the engagement
- Insight into the top types of phishing emails your organisation is receiving
- Insight into the top types of payloads being used in the phishing emails your organisation is receiving
- Insight into your Supply Chain Health (DMARC status of inbound emails)
- Insight if there are live phishing attacks sat in employees inboxes that can be remediated together
- Phishing Simulation results (with and without an ICES solution implemented)
- Previous caught user analysis breakdown
- Insight into how many users were stopped in their tracks at the link advisory page
- Insight into the reporting heroes in your organisation
- Insight into what device type your employees are engaging business emails on. (mobile, PC, both)
- Consultative recommendations for security best practice
If you'd like to learn more, you can visit https://www.spearshield.co.uk/human-activated-risk or contact the team today:
01473 948980
About Spear Shield
Here at Spear Shield, we are continuing to invest in our goal to create one of the most cyber-secure client communities in Suffolk, East Anglia and across the UK.
