Business Email Compromise
Business email fraud - BEC
The most significant financial threat to organizations
What is BEC?
Business Email Compromise (BEC) is a sophisticated type of phishing attack in which attackers impersonate senior executives, suppliers or business partners in order to cause fraudulent fund transfers or the theft of sensitive information.
Unlike regular phishing that is distributed en masse, BEC attacks are highly targeted and based on in-depth research of the target organization - organizational structure, managers' names, suppliers, organizational language and business processes.
According to the FBI: BEC caused damage of more than $43 billion worldwide between 2016 and 2021, and it is the most significant financial threat to organizations.
The worrying numbers
Global damage from BEC attacks (2016-2021)
Increase in BEC attacks in the last two years
The average transfer in a successful BEC attack
Types of BEC attacks
CEO Fraud
Impersonating the CEO or a senior executive who asks for an urgent fund transfer
Example:
"A fake email from 'the CEO' to the finance manager: 'We are in the middle of a secret deal - transfer ₪500,000 to this account right now!'"
Account Compromise
Breaking into a legitimate email account and using it to send fraudulent requests
Example:
"An attacker gets into a manager's email account and sends, from the real account, a request to transfer funds"
Invoice Manipulation
Changing account details in legitimate supplier invoices
Example:
"An attacker intervenes in the correspondence with a real supplier and sends an 'updated' invoice with their own account details"
Attorney Impersonation
Impersonating a legal advisor or an external accountant
Example:
"A fake email from a 'law firm' asking for money to be transferred to close an urgent deal"
Data Theft
A request for sensitive information such as payroll reports, W-2 forms or financial information
Example:
"A fake email from the 'human resources department' asking for a list of employees with bank details"
Documented BEC cases
Toyota
An employee at a European branch transferred $37 million after receiving fake emails impersonating senior executives and a business partner. The attackers used slight changes to the email addresses that were not noticed.
Facebook & Google
A Lithuanian man managed to take $100 million from Facebook and Google by impersonating Quanta Computer (a real supplier). He sent fake invoices for two years and the companies paid without verification.
Ubiquiti Networks
Attackers impersonated senior executives and persuaded the finance department to transfer $46.7 million to 'foreign accounts' under the guise of a confidential acquisition.
How do you protect against BEC?
Protection against BEC requires a combination of technology, procedures and employee training
Multi-channel verification
Every request to transfer funds above a certain amount must be verified by phone (from a number known in advance) or face to face
Segregation of duties
At least two people must approve fund transfers - no one can approve alone
SPF, DKIM, DMARC
Implementing email authentication protocols to prevent address spoofing
BEC scenario training
Specific BEC simulations for employees in finance, procurement and management
Clear processes
Formal procedures for changing suppliers' account details - approval through a separate channel
Monitoring anomalies
Systems that detect unusual transfers, new destinations or large amounts
Prepare your organization for the BEC threat
PhishingU's phishing exercises and simulations include BEC scenarios focused on finance departments and management
Book a free consultation meeting* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.