A business email compromise is a type of cybercrime that is becoming increasingly prevalent, causing significant financial losses to companies around the world. This sophisticated scam can be difficult to detect and is specifically designed to exploit weaknesses in a company’s internal processes and technology.  

Understanding what business email compromise is, how it operates, and what some warning signs are will help you prevent your business from falling victim to this kind of attack. 

What is Business Email Compromise (BEC)?  

BEC is a type of cybercrime in which a hacker targets a senior executive or another company employee to make them transfer funds to an account controlled by the hacker or to reveal sensitive information.  

How does it work?

To obtain control of a senior executive or an employee of a company, the hacker sends an email to a senior manager that directs the user to “fake websites” that look very similar to the websites of legitimate entities to steal email information.  In some circumstances, the hacker will send attachments to the senior manager’s email containing a virus that will be activated when accessed. 

Once the hacker gains access to the email, they can carry out several malicious activities, including: 

• Sending requests to the finance department from the senior executive’s email address, requesting payments be made to an account controlled by the hacker. 
  

• Posing as a trustworthy supplier or vendor, seeking a change in payment method or bank account details, and providing a new bank account number controlled by the hacker. The email may also include a sense of urgency or a convincing reason for the change in payment method. 
  

• False job offers are made to potential applicants, requesting personal information such as Social Security numbers, bank account details, and passport information via an email from a human resources employee. The hacker may exploit this information for identity theft or unauthorised transactions from the individuals’ accounts.

 These are just a few examples of the many ways a hacker might exploit a BEC. 

Why Should Businesses Care?

BEC attacks can result in significant financial losses for companies. In some cases, the hacker may request large sums of money to be transferred, and if the company’s finance department does not detect the fraud, the funds may be sent to the hacker’s account. 

In addition to financial losses, BEC attacks can also cause damage to a company’s reputation and can be costly to resolve. Companies may also face legal consequences if they are found to have ignored red flags and transferred funds to an unauthorised party. 

Red Flags for BEC  

It’s essential for companies to be aware of red flags that may indicate a BEC attack. Here are some common red flags to watch out for:  

• Emails from organisations or people that the company does not usually do business with 
• Emails that appear to come from a senior manager requesting payment to a person or organisation not known or with an unusual email address 
• Emails that request immediate action for payment 
• Emails stating changes in an account number and bank information for any reason 

How to Protect Your Company?

To protect your company from BEC attacks, it’s important to implement security measures and procedures that help prevent fraud and protect sensitive information. Here are some steps you can take to protect your company:  

• Use secondary channels to verify requests for changes in account numbers 
• Check the URL included in emails to confirm that it’s associated with the business it claims to be from 
• Avoid clicking on hyperlinks sent by email and use the official link of the client instead 
• Ensure that employees’ computers have appropriate security standards 

In conclusion, business email compromise is a sophisticated and growing threat to companies around the world. By understanding what BEC is, how it works, and what red flags to watch out for, companies can take proactive measures to protect themselves from this type of cybercrime.