What are BEC Scams?
Business Email Compromise (BEC) scams, also referred to as Email Account Compromise (EAC), Email Fraud, Email Spoofing, are sophisticated cybercrimes that continue to plague businesses worldwide. By infiltrating company email accounts, cybercriminals can execute a variety of fraudulent schemes, often resulting in significant financial losses.
Understanding the BEC Threat
There are three primary types of BEC scams:
- Invoice Fraud. Cybercriminals hack into a company’s email account and modify legitimate invoices, redirecting payments to their own accounts.
- Employee Impersonation. Hackers impersonate employees, often those in positions of authority, to trick colleagues into transferring funds or sharing sensitive information.
- Company Impersonation. Criminals create fake domains that mimic legitimate companies to defraud unsuspecting businesses.
Real-World Examples of BEC
- Invoice Fraud. A cybercriminal gains access to a company’s finance department email and alters an invoice, changing the bank account details. The unsuspecting customer pays the invoice, unknowingly transferring funds to the criminal’s account.
- Employee Impersonation. A CEO’s email is compromised, and the hacker sends a message to an employee, requesting an urgent wire transfer. The employee, believing it’s a legitimate request, complies, leading to substantial financial loss.
- Company Impersonation. A fake domain is created to mimic a well-known supplier. The criminal sends a fraudulent invoice to a company, demanding immediate payment. The company, unaware of the scam, transfers funds to the criminal’s account.
7 Cybersecurity Strategies to Help Protect Your Online Presence
Protect Your Business: Why Every MSME Needs Cyber Insurance
Small Businesses Face 31,000 Cyber Attacks Per Day: Are You Prepared?
Protecting Your Business from BEC
To safeguard your business from BEC attacks, implement the following strategies:
- Employee Training. Regularly train employees to identify and report suspicious emails, including those with unexpected requests, urgent deadlines, or unusual payment instructions.
- Multi-Factor Authentication (MFA). Enforce MFA for all employee accounts to add an extra layer of security.
- Email Security. Utilize advanced email security solutions, such as email authentication protocols (DMARC, SPF, and DKIM) to verify the authenticity of emails.
- Regular Security Audits. Conduct regular security audits to identify vulnerabilities and implement necessary security measures.
- Stay Informed. Stay updated on the latest BEC tactics and trends by following cybersecurity news and industry best practices.
Regional Resources for APAC
To further protect your business, consider consulting with regional cybersecurity experts and organizations. Here are some valuable resources:
- Asia Pacific Computer Emergency Response Team (APCERT) A regional organization dedicated to cybersecurity incident response and information sharing.
- Cybersecurity Malaysia The national cybersecurity agency of Malaysia, providing resources and guidelines for businesses.
- Singapore Cyber Security Agency (CSA) The national cybersecurity authority of Singapore, offering cybersecurity advice and support.
- Australian Cyber Security Centre (ACSC) The Australian government’s cybersecurity agency, providing information and guidance on cyber threats.
- New Zealand Computer Emergency Response Team (CERT NZ) A government agency providing cybersecurity advice and support to New Zealand organizations.
- The National Computer Emergency Response Team (NCERT) Division under the Cybersecurity Bureau, Philippine Department of Information and Communications Technology (DICT) is responsible for receiving, reviewing, and responding to computer security incident reports and activities.
Understanding the risks and taking proactive measures can significantly reduce your business’s vulnerability to BEC attacks. For more information on BEC scams and cybersecurity best practices, consult with a cybersecurity expert or visit the following resources:
- Federal Bureau of Investigation (FBI): https://www.fbi.gov/investigate
- Cybersecurity & Infrastructure Security Agency (CISA): https://www.cisa.gov/