Global losses from business email compromise scams, a highly sophisticated form of phishing, grew by 136% between December 2016 and May 2018 and now exceed $12 billion, according to a public service announcement released by the FBI.
What Is a Business Email Compromise Scam?
A business email compromise (BEC) — also known as an email account compromise (EAC) or “CEO fraud” — is a form of spear phishing that primarily targets businesses or individuals who perform wire transfer payments. Some BEC variations seek employee tax data or other personal identifying information, such as a very large business email compromise scheme that targeted HR and payroll professionals in 2016.
Business email compromise schemes are far more sophisticated than regular phishing due to their highly targeted nature and the reconnaissance involved. BEC scammers don’t blindly send out emails; they do their homework, scouring company websites and social media profiles to gather information on specific targets.
A business email compromise scam generally unfolds as follows:
1. A victim receives an email that appears to be from a high-level company executive, company attorney, or business partner. However, the email address has been spoofed — or the sender got hold of a high-ranking user’s email login credentials, usually through a separate phishing scheme.
2. The email includes an urgent request for a wire transfer or, alternatively, employee payroll information or other personal data. The victim is implored to act immediately; for example, an email may claim that the money is for a seriously past-due invoice.
3. The email may even be followed by a phone call to further bolster legitimacy.
4. Thinking the request is legitimate, the victim sends the wire transfer/information.
While business email compromise scams can hit any industry sector, the FBI reports that the real estate industry, including real estate agents, title companies, law firms, and even buyers and sellers, has been heavily targeted in recent years. From 2015 to 2017, the real estate industry saw a 1,100% rise in the number of reported BEC incidents and a 2,200% increase in BEC losses. These BEC scams are a bit different than the scenario described above in that they don’t involve fraudulent requests for payment and instead seek to redirect legitimately owed funds to fraudulent accounts. The FBI elaborates:
Victims most often report a spoofed e-mail being sent or received on behalf of one of these real estate transaction participants with instructions directing the recipient to change the payment type and/or payment location to a fraudulent account. The funds are usually directed to a fraudulent domestic account which quickly disperse through cash or check withdrawals. The funds may also be transferred to a secondary fraudulent domestic or international account. Funds sent to domestic accounts are often depleted rapidly making recovery difficult.
Defending Against Business Email Compromise
Employees must be trained on how to spot BEC and other phishing scams. Additionally, because business email compromise scammers perform reconnaissance on company websites and social media networks prior to launching attacks, both company executives and rank-and-file employees must be taught about the dangers of sharing personal information on social media sites.
Technical defenses against BEC schemes include:
* Secure company email systems with multi-factor authentication and the DMARC email security protocol.
* Require that all employees use official company email addresses — not free, web-based email clients — for official company business.
* In most cases, businesses probably shouldn’t use a private email server, as they are very difficult and time-consuming to secure.
However, the best defense is to bake redundancy into sensitive operational procedures such as releasing wire transfers or employee tax data or changing payment type or location; mandate that all such requests be verified and authorized by more than one person.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.