INFOGRAPHIC
Proofpoint stresses need
to combat email attacks
RECOGNIZING AND AVOIDING
BUSINESS EMAIL COMPROMISE ATTACKS
Stop Wire Transfer Fraud in Its Tracks
BEC Q&A
What Is Business Email Compromise?
Who Is Targeted in a BEC Attack?
A business email compromise attack — also known as a BEC attack
— is a type of phishing attack in which a cybercriminal impersonates
a high-level executive or other trusted contact and uses social
engineering techniques to trick an email recipient into transferring
funds into a fraudulent account.
How Does a BEC Attack Happen?
BEC attacks are often highly sophisticated and carefully planned,
making it difficult for a target to identify the scam. Cybercriminals
generally follow a pattern like the following:
Cybercriminals seek out situations in which fund transfers happen on
a regular basis, and they have been known to attack organizations of
all sizes across all sectors, as well as individuals. Anyone who is
authorized to complete financial transactions as part of a normal
course of business could be a target. Frequent victims include
company controllers, accountants, and parties involved with real
estate transactions (including agents, buyers, and sellers).
DO THE RESEARCH LAY THE GROUNDWORK
The attacker will identify an organization
and/or the targeted individual(s). They
will then gather information using social
media channels, publicly available data,
and phone calls, developing
profiles they can draw on to
create believable communications. Attackers attempt to build relationships with individuals
who have access to financial accounts. They often use a combination of
phone calls and “spoofed” or hacked email messages, which appear as
though they are coming froma trusted source (like a CEO, CFO, external
supplier, or law firm). Multiple communications can take place over days,
weeks, or even longer in order to create a sense of trust and familiarity.
STEAL THE FUNDS
The money is routed to an account
controlled by the attacker. By the time
the attack is discovered, it is generally
too late to track or recover the funds.
SET THE TRAP
Ultimately, the attacker asks the target to initiate a wire
transfer for a seemingly legitimate business reason.
Because the target believes the attacker is someone they
trust, they often act on the request without reservation.
Are BEC Attacks Strictly About Wire Transfer Fraud?
BEC attacks are most commonly tied to fraudulent wire transfers, but similar techniques have been used to
obtain sensitive information, like wage and tax statements and other confidential employee data. In these
cases, the target is asked to send employees’ personally identifiable information (PII) to a seemingly legitimate
requester, and that data is then used to commit tax fraud and other crimes.
Source: Federal Bureau of Investigation Public
Service Announcement, July 12, 2018
78,000 global incidents
$ 12.5 billion
in exposed losses reported by
financial institutions worldwide
BEC by the Numbers between October 2013 and May 2018:
reported by financial institutions worldwide
43,000 victim complaints
worldwide with $ 3.6 billion in
exposed losses
136 % increase in identified exposed losses between December 2016 and May 2018
BEC scams reported in
150 countries and
all 50 US states
Fraudulent wire
transfers sent to
115 countries
Approximately 900 reported W-2 phishing attacks in 2017
Source: Internal Revenue Service News Release, January 17, 2018
28
BEC Prevention and Protection
INTELLIGENTCIO
BEC
attacks cannot succeed if you don’t take the bait! Use these tips to identify and avoid these types of attacks, and protect
your organization’s
www.intelligentcio.com
funds, your coworkers’ data, and your own reputation.