Businesses in the USA lose billions of dollars yearly because of cleverly executed Business Email Compromise (BEC) attacks. Most news reported by media outlets revolve around ransomware and data breaches. But corporations report more losses because of BEC attacks than ransom infiltrations.
It is a fact that money-driven cybercriminals would use any way possible to steal, and BEC has proven very lucrative for them as BEC attacks aim to convince victims into performing legitimate fund requests, i.e., hackers don’t need to deal with ransom negotiation nor sell stolen data on the black market.
While some attacks are sophisticated, fraudsters often don’t rely on technical know-how to compromise a business system but on human emotions and social engineering. The FBI receives tens of thousands of BEC-related complaints every year, and a few months ago, it released a scam alert that gives an idea of how BEC works and how to report and protect such crimes.
Who are the most common BEC targets?
Everyone in an organization who operates with funds or handles banking information is a potential target for fraudsters. The most often targets are likely an organization’s finance, accounting, and accounts payable departments. The names of employees from those teams are often readily available on LinkedIn and other social media networks.
How do scammers carry out the attacks?
The FBI has categorized scammers’ actions into three main categories. Bad actors could spoof an email account or website, send spearphishing emails, or deploy malware.
- Spoofing email accounts means that the receiver would get a message from an email resembling a real one. Scammers would add/change/remove one or two characters to convince potential victims that the message is legit. Scammers hope that the small changes will go unnoticed.
- Often, criminals target a specific person within an organization and include information that is known to be of interest to the recipient. Suppose a business is making an acquisition or equipment purchase. In that case, the hackers might trick the controller into believing the email with wire instructions is legit. Only to realize that the employee has made a pricey mistake when the actual invioce arrives.
- Malicious code that somehow manages to get into a company system can access real billing threads and share all that info with cyber criminals, who can then submit invoices in a manner that would not raise suspicion among the folks working at the accounts payable department. Such scams can go on for years without being noticed.
How not to become a victim?
Always verify requests, especially if they seem urgent. Make sure the system administrator deploys the latest anti-virus solutions, and avoid opening suspicious email attachments or clicking on such links. Always double-check with the other party when a payment process requires amendment or when new vendors must be added to the system.
The post Business Email Compromise fraud continues to haunt corporate America appeared first on Panda Security Mediacenter.
Article Link: WatchGuard Blog | WatchGuard Technologies