A BEC attack (business email compromise) is a scam in which criminals use fraudulent or hijacked email to trick managers, finance staff or suppliers into sending money or data. Attackers often pose as an executive, a vendor or a lawyer. Checking every payment request through a second channel is the main defense.
BEC attacks are a type of cyber attack that is carried out with financial motivation. Threat actors, often targeting a business’s finance department or business partners, use fraudulent e-mails to defraud managers or employees to get them paid.
Threat actors, who prefer corporate e-mail addresses or addresses very similar to real accounts, obtained by various methods such as malware or social engineering attacks, start the chain of raids by pretending to be a corporate executive, finance employee, or lawyer.
What Are the Types of BEC Attacks?
CEO Fraud
Threat actors pretending to be the top executives of a business attempt to manipulate the organization’s financial transactions using pretexts such as emergency or confidential transactions to the victim.
Between 2013 and 2015, two major tech firms, Facebook and Google, faced a BEC attack that cost them more than $120 million. Threat actors set up a fake company called “Quanta Computer” with the same name as an actual hardware supplier. They sent bogus invoices and payment requests to corporate personnel via e-mail addresses that seemed to belong to real company executives. The attackers also forged lawyer letters and contracts to get their banks to accept wire transfers.
Data Theft
Attackers sometimes target the HR department and try to obtain critical information such as the victim’s work schedule and phone number. This method is preferred to increase the credibility of BEC attacks.
Impersonating a Lawyer
Threat actors gain unauthorized access to a law firm’s e-mail account, forwarding customers an invoice to pay them online or a fake link to obtain personal information.
In 2019, a law firm in New York was exposed to a fraudulent attempt by an attacker posing as a lawyer. The attacker sends an e-mail to the business’s finance department with a fake e-mail address posing as a business’s attorney, stating that an invoice is due in a legal case and that the invoice amount must be paid urgently. Thereupon, the finance department made the payment by fulfilling the request of the fake lawyer, who introduced herself as the business lawyer.
This incident demonstrates how serious a threat can be created by swindling attackers using a false attorney ID. To protect themselves from such attacks, businesses must verify payment requests to their finance department and confirm the attorney’s identity before directly contacting anyone pretending to be the business’s attorney.
False Invoice Scam
In this type of attack, the attacker pretends to be a vendor demanding payment for services performed for the company.
How Do BEC Attacks Work?
Identifying a Target
For the threat actors to create the attack scenario, they must conduct targeted research. Information about employees’ names, job titles, payment processes, supply chain, and workflow is obtained by scanning open sources such as the corporate website, social media accounts, and media news.
Obtaining the E-mail Address
At this stage, threat actors try to capture e-mail addresses they can use with the methods listed below.
- Phishing Attacks
- Malware Attacks
- Using a Similar E-Mail Address
Payment Request
Fake e-mails that appear to come from an employee or manager often include an order to make an urgent payment or any financial transaction. Threat actors try to pressure the target by emphasizing the urgency or confidentiality of the payment to avoid detection.
- Identify a targetResearch names, job titles, payment processes and suppliers from open sources.
- Obtain an email addressPhishing, malware or a similar looking address.
- Send the payment requestA fake email stresses urgency or confidentiality.
A BEC Attack Example
A BEC attack scenario has been detected recently, which has been observed to affect many organizations.
When we researched the address “CONTACT@saintbonnetdemure.com” that sent the relevant e-mail, it was understood that the e-mail extension belonged to an institution.
However, this e-mail account may contain malware, leak data, etc. It has been observed that it is used to spread phishing e-mails by being captured by threat actors as a result of situations, and it is called a BEC attack (Business E-mail Compromise).
Although the threat actor claiming to have bought account access in the e-mail claimed to have accessed your network in this way, the text content of this fraudulent e-mail that has been distributed for years has not been changed, and only the BTC wallet address under the control of the sending threat actor has been added to the e-mail.
In this sense, it is thought that the relevant e-mail is a spam e-mail connected to the social engineering scenario, and the statements in the content are not real.[
What Are the Warning Signs of a BEC Attack?
Instant Money Transfer Requests
Attackers demand payment from the victim with definitions such as urgent, confidential, and debt in the fake e-mail messages sent. These requests are often backed by an apparent reason, such as a crisis, and a prompt response is sought.
Presence of Unknown/Unusual Email Accounts
E-mail addresses created by threat actors impersonating corporate or individual e-mail accounts may contain spelling and grammatical errors. A sense of urgency is used to avoid noticing these mistakes. For this reason, it is necessary to read the e-mail contents and verify the source carefully.
Unusual Requests
Attackers can send a fake email requesting the victim’s company information or employee information.
Sudden Password Changes
Attackers can change the password after gaining access to the victim’s account. Additionally, abnormal activity in reports can be a clue to the attack.
What is the Difference Between BEC Attacks and Phishing Attacks?
Although BEC attacks look similar to phishing attacks, they are considered different types of attacks.
Phishing attacks are a type of social engineering attack in which attackers try to gather information from a legitimate institution, person, or organization using a false identity. Attackers often aim to obtain victims’ data using email, SMS, or fake websites, such as usernames, passwords, or banking information.
BEC attacks, on the other hand, are generally more sophisticated and require serious preparation for the target. An attempt is made to persuade other employees or suppliers to make payments through a false e-mail address or communication channel by impersonating an employee or senior manager in an institution or organization.
| Topic | BEC attack | Phishing attack |
|---|---|---|
| Aim | Persuade staff or suppliers to make payments | Gather data such as usernames, passwords or banking details |
| Method | Impersonate an employee or senior manager by false email or channel | Fake identity by email, SMS or fake websites |
| Preparation | More sophisticated, needs serious preparation on the target | Social engineering aimed at a legitimate institution, person or organization |
How Can You Prevent a BEC Attack?
- As much as possible, 2FA features should be activated. The implementation of multi-factor identity protection makes it difficult for attackers to access e-mail addresses.
- The source of the content transmitted with themes such as urgent payment and requesting personal information must be verified.
- Untrusted e-mails, attachments, and links should not be respected. Files and applications should be obtained from reliable sources.
- The probability of success of BEC attacks is directly proportional to the data collected by the attacker about the target. For this reason, it is essential not to share personal information openly.
- Configuring e-mail solutions (SPF, DKIM, DMARC, and SID; our free domain security checks show how to test them) is recommended to prevent sending harmful e-mails from unknown or suspicious sources, phishing (phishing), and spam content.
Brandefense’s Solutions
Attackers gather information about their targets before carrying out BEC Attacks. In addition to resources such as social media and news pages, the Dark Web is also frequently used by attackers to gather information.
Compromised third-party applications are accessible to anonymous individuals on various Underground forums. Through such data leaks, critical data such as name, surname, phone number, e-mail, and password of the personnel of the institution may be disclosed.
In addition, the Dark web is the first place cyber threat actors sell the data obtained due to their attacks. It is essential to access the leaked data quickly with properly conducted research to take action promptly.
At this point, Brandefense keeps track of all customer posts on Deep&Dark Web and informs you of critical data that the attacker can use.
Another method used in BEC Attacks was the capture of e-mail addresses belonging to senior executives. With the Brandefense VIP Security module, all information that attackers can access, such as personal information, phone number, and e-mail address leaked to the internet, is determined by searching the VIP person belonging to your institution.
Phishing e-mails forwarded to you and fake websites that appear to belong to a legitimate source are other methods used to snatch e-mail addresses.
With the Phishing Monitoring module, Brandefense can detect applications that may be of interest to your domain and imitate your institution. If deemed necessary, it provides a “Takedown” service and supports the closing of the fake application as soon as possible. In addition, suspicious-looking e-mail addresses, file attachments, and links are analyzed by the Brandefense team so that you can take action.
BEC attacks pose severe risks to businesses of all sizes. These attacks can cause significant financial and reputational losses. However, businesses can significantly reduce the risk of BEC attacks by implementing simple but effective steps such as training staff on social engineering attacks and proper verification procedures.
Organizations must stay alert and up-to-date on the latest security measures to protect themselves against this growing threat. Businesses can protect their finances and ensure the safety of their customers and stakeholders by prioritizing cybersecurity and taking proactive steps to prevent BEC attacks.