Business email compromises (BEC) scams made a big statement in 2018, seeing a 133% increase over 2017, according to a recent report by Beazley Breach Response Services.
The Beazley Breach Briefing looked at information gathered from investigations into more than 3,300 data incidents that were reported to Beazley in 2018.
The investigations revealed that nearly half (47%) of the data incidents investigated were the result of a hack or malware. Diving deeper, the investigations revealed that half of those hacking or malware incidents were BEC scams.
What is a BEC scam?
BEC scams, also known as CEO fraud, have become a favorite for cybercriminals. A BEC scam requires the scammer to do their homework by using social engineering tactics to determine who the CEO or CFO is, and who the victims will be. Despite the effort it takes to make this scam successful, cybercriminals favor it due to the high profits it yields, even if only a few attempts are successful.
Typically, the scammer will target an employee working in the finance department, or one who would not find a request for a money transfer unusual. Then, the cybercriminal sends a fraudulent email to their victim, impersonating the CEO or CFO, requesting a wire transfer. These emails often have a sense of urgency for the transfer and may state that the “CEO or CFO” who is sending the email is in an important business meeting and cannot be bothered.
BEC scams can be tricky to detect. Scammers will often create an email address very similar to the individual they are impersonating. In some cases, scammers may even have control of the CEO’s or CFO’s actual email account, making the scam even more convincing.
The goal of the scam is to trick the victim into performing the requested function (most often a wire-transfer or electronic payment to the criminal’s bank account but could include transferring sensitive data) as quickly as possible without giving it a second thought.
The Beazley Breach Briefing reported that 24% of the incidents that were investigated from 2018 were the result of a BEC scam, up from 13% in 2017. The rise in BEC scams year-over-year is a major cause for concern and should prompt organizations to take proactive measures to protect themselves.
How to prevent a BEC scam
- Use multi-factor authentication
- Train employees regularly on cybersecurity
- Limit employees who can authorize wire transfers
- If a vendor requests changes to an account, confirm requests by a direct phone call using pre-agreed phone numbers
- Review requests by getting them approved by a next-level approver prior to making changes
- If approved, check that the address or bank account match those that were used previously for payments
Leave a Reply