First, the FBI recently reported business email compromise attacks were up 65% from July 2019 through December 2021 and totaled $43 Billion dollars – that’s BILLION with a B – in reported losses from June 2016 through July 2019.
Additionally, if you and your team do business on the internet, you are at risk. Okay, that sounds click-baity, too, but it’s absolutely true. We’ve said it over and over. There are plenty of proactive options to build a strong strategy.
So that’s the headline in a nutshell. But if we wanted to just pass along Twitter-length-approved paragraphs, we’d probably do that on Twitter instead, right? So let’s take this opportunity to sit back and read like, I dunno, around 1000 words about one of the most dangerous threats to your business and discuss:
Business Email Compromise, or BEC for short, is a form of social engineering which is an attack where someone uses human interaction and some form of social skills to compromise crucial info regarding a business and its computer systems. Attackers may seem unassuming and respectable through their interactions, nearly always taking a false identity that disarms the target.
To attempt to capture specific answers and/or seduce – yeah we said it – clicks where they aren’t deserved, often legitimate senders' addresses can be spoofed or written similarly enough to pass as identical. When sending out mass attempts, generic greetings, and signatures, which often don’t match the content of the email, are included with spoofed hyperlinks and websites.
Finally, many use the dreaded malware. Malicious software can be instructed to infiltrate target networks to gain access to email threads about financial topics. That information is then used to time specifically spoofed requests, or send messages to accountants to create a mirage. Malware is also an easier way for criminals to gain access to data like passwords and financial account information.
According to the FBI’s IC3 2021 Internet Crime Report, BEC scams were the cybercrime with the highest reported total victim losses last year. However they choose to gain access, the overarching goal is always to break into the network to… you know… *blank* stuff up… though the specific end game is often different depending on the victim, attacker, and situation. It’s impossible to say why businesses are chosen; often there are hundreds or thousands in the crosshairs at once while only a few fall victim in the end.
Source: 2021 IC3 Report
Essentially, BEC is effective because it uses the social engineering and specifically timed messaging mentioned before to hide what’s going on, the same way a magician uses smoke and mirrors to redirect the eye. Though many of these bad actors would fail to fool Penn & Teller on their television show, the FBI has revealed the steps these criminals are using, breaking the magician’s code.
Okay, so it’s not that magical of a process. In fact, it’s pretty straightforward. But that’s what makes it so effective. It’s simple.
We’re all so busy we hardly have time to stop and check every single character of an email. Many managers at sprawling organizations have no way of knowing what new hire started states, countries, or even hemispheres away. We click links without checking them all the time – just ask my dad.
So at this point, you have to be asking yourself the question from the title of this section. Or you’re skimming around and are confused about how we got here – scroll back up, Derek.
First and foremost, literally, if you suspect or detect a breach, you must contact your financial institution and IT and report the trouble immediately. Right away. (Is that clear enough?) After that is taken care of, you will be armed with the information necessary to contact your local FBI field office to report the crime, where you may be directed to file a second report with the Internet Crime Complaint Center (IC3).
Additionally, here are some other ways to proactively protect yourself and your business:
Let’s say this: We really, really hope this never becomes a problem for you. It seems like a huge pain in the butt, and we’re firm believers in working hard to prevent situations like this from ever occurring. The path toward safety is paved with potholes, especially in an increasingly digital workplace. With new technology comes new challenges, but the best news is that if you follow the guide to staying safe, it is very unlikely to affect you and your business.
To learn more about how to protect your business from the $43B scam of business email compromises, give us a call at (864) 552-1291 and we'll help you evaluate capabilities and options. Also, sign up for PTG Tech Talk for bi-monthly tech news and consider following us on LinkedIn, Facebook, and Twitter!