Business email compromise (BEC)

Business Email Compromise (BEC) is a type of security threat targeting corporate and international payment systems. It is one of the most rapidly growing threats to corporate cyber security, and has become the go-to method of choice for cybercriminals looking to defraud companies and consumers out of large amounts of money.

BEC attacks commonly originate from email and focus on exploiting the weakest point in the corporate security perimeter: humans. BEC go beyond the typical phishing attack by posing as an executive and sending emails containing malicious links, requesting unauthorized transfers of money, or asking for sensitive information.

In one type of attack, a hacker impersonates a company working partner or client and sends an email to a trusted company employee with a request for a wire transfer. The employee has no reason to suspect that the request is fraudulent, and agrees to the transfer. Once the funds have been moved, they are nearly impossible to trace or recover.

In another type of attack, a hacker may impersonate a CEO or other C-level executive and send an email to an employee in payroll or accounts payable with instructions to transfer funds to a bank account. This type of BEC attack is especially dangerous because payroll and accounts payable employees are often presented with multiple requests and do not have the discretion to decline requests made from upper-level executives.

In addition to financial losses, businesses impacted by BEC attacks often suffer reputational damage, as well as regulatory fines resulting from lack of compliance with anti-money-laundering rules.

Businesses should take measures to protect themselves from BEC attacks. These measures include the use of strong passwords, the enforcement of two-factor authentication, and the implementation of employee security awareness training. Additionally, businesses should maintain up-to-date antivirus software, and ensure their acceptance and organizational email policies cover the prevention of BEC attacks.