It’s been a long time since a threat focused the attention of cyber-security professionals quite like Business Email Compromise (BEC). Dubbed cyber-security’s priciest problem, BEC recently took the headlines at the Gartner Security Summit where it was picked out as a major threat facing organisations worldwide. With cases reported in 150 countries along with all 50 US states, what makes the rise of BEC so concerning is not necessarily its increasing prevalence—attacks rose by 297% across 2018—but its worryingly high success rate. Between December 2016 and May 2018 alone, the value of identified exposed losses increased by 136%. BEC is so potentially damaging that the FBI issued a Public Service Announcement in September of this year warning of the threat and estimating that it has cost global businesses around $26bn since 2016.
Anatomy of an attack
The mechanics of a BEC attack helps explain its continued success. BEC takes place when an attacker poses as a trusted individual within an organisation to reroute funds or access privileged data. This occurs either by spoofing a company domain or commandeering a legitimate email account. This is a particularly effective tactic, as there is nothing to suggest to a recipient that any correspondence coming from this account is anything other than genuine.
BEC attacks are usually highly targeted, aimed at specific decision-makers or those in authority. Anyone authorised to complete financial transactions during the normal course of business is potentially a target. A typical sophisticated BEC attack can be broken up into four stages:
-
The research: Unlike mass, blanket attacks, BEC attackers usually take the time to identify specific individuals within an organisation. Information is gathered from a range of sources to create believable communications once the account is compromised.
-
The groundwork: BEC attackers often attempt to build relationships with those who have financial decision-making authority. Usually through spoofed or compromised email accounts, this interaction can take place over days, weeks or even months to build trust and familiarity.
-
The trap: Once the attacker has compromised an account, or accounts, and is satisfied that the victim believes them to be genuine, they make their move. In most cases, the target is asked to initiate a wire transfer or alter payment details on an existing pending payment.
-
The fraud: Believing the request to be genuine, the victim sends funds to the fraudster’s account. These are usually moved on quickly, making them harder to recover once the fraud has been discovered.
As scams often take the form of an everyday request, such as changing payment details, and seemingly come from legitimate senders, they are incredibly difficult to defend against. Unlike other popular methods of attack, components of a BEC attack often carry no detectable threat. With spoofed emails or after an email account is already compromised, the attacker doesn’t need to include a dangerous link or a virus-laden attachment—nothing that is likely to set off alarm bells.
The attacks also target people, not networks, and play into simple human psychology. Lower-level employees, who are usually the target of fraudulent requests, are less inclined to question the authority of CEO, CFO or someone of similar rank. BEC attackers rely on this natural human instinct to defer to those in authority. This is very effective against internal targets, but BEC attacks can just as easily target external suppliers using urgent-sounding correspondence on invoices, payments or acquisitions, where huge amounts of money can be unwittingly funnelled into the wrong hands.
Once an account compromise has taken place, an attacker is inside the defences of the organisation. With no questionable attachments or bogus links to raise the alarm, fraudulent requests can sail through even the most robust email security and into the inbox of an unwitting victim.
Safety first
BEC is an attack on a human target and therefore requires a human approach. The only way to successfully fend off such an attack is to ensure everyone in the organisation knows exactly how to spot one. The first step is to train employees to be on the lookout for changes in the behaviour of suppliers, bosses, HR colleagues, accounts departments and the like. Any out-of-the-ordinary requests or amendments should be heavily scrutinised. All employees at all levels should also be practising basic security hygiene—using strong, unique passwords for all accounts, not just those connected to work, and making use of two-factor authentication where possible.
Unfortunately, due to the nature of BEC attacks, even the most robust training and protections are unlikely to keep out 100% of attempts. The fact remains that even with these defences in place, many BEC attacks continue to slip through the net—an effective attack is often indistinguishable from a genuine email request. All organisations should thus consider introducing verification systems for certain requests, such as changes to payment details, direct deposit for pay packets, or new requests made via email for payments of any sort. If there is a financial consequence to any action, it should not be actioned solely via email. Requests of this nature should be verified independently, away from a company’s email system, via a known and recognised telephone number. This simple step can undo weeks, if not months, of hard work for an attacker and keep your funds out of their hands.
Ultimately, BEC works because it is low-profile and unassuming. Rather than trying to spot a smoking gun, organisations should train their employees to be vigilant about all forms of email communication. Additional verification may add a few minutes of inconvenience when approving a genuine request, but that’s nothing compared to the pain of a successful BEC attack.
