There are many different types of Business Email Compromise (BEC) attacks, but the smartest and most likely to succeed are often timed to coincide with something that can lend them legitimacy, such as tax season.
By infiltrating an organization to find a few useful details, scammers can craft email messages that are perfectly timed and convincingly urgent enough to persuade victims to transfer large sums of money.
The potential risk to your business is enormous; the FBI estimates the cost of BEC scams worldwide between October 2013 and July 2019 was more than $26 billion, mostly stolen from U.S. organizations.
The mechanics of different types of BEC attack are very similar, so by breaking them down and educating your workforce you can dramatically reduce the risk for your business.
What Does a Typical BEC Scam Look Like?
A successful BEC scam requires some knowledge of your organization’s internal workings. Criminals will identify a target business – all sizes and types of organization are at risk – and they will work to gain access to your network. The first step is likely to be a common phishing email that enables them to gain a foothold. From there, they will try to figure out how financial processes are handled and who is responsible for money transfers.
With the groundwork complete, they will wait patiently for an opening. A typical example is an incoming invoice for services from a vendor. The attacker will see this email coming in and they’ll quickly follow it up with a message that appears to come from the same vendor, explaining that they’ve just changed their account, and asking you to wire the money for the last invoice to these new details. Naturally, the new bank details provided are the scammer’s account and the victim likely doesn’t find out there was a scam until the vendor makes an inquiry about their unpaid invoice a few weeks later.
How Tax Season is the New Hunting Season
Another way attackers can boost their chances of perpetrating a successful BEC scam is to take advantage of particular times of year, such as tax season. People are more receptive to tax-related emails when it’s tax season and there are many ways to trick victims into handing over details, opening attachments or clicking somewhere they shouldn’t.
An email asking people to verify “the attached W2” is an easy place to start. No one wants to pay more tax than they need to, and when they know taxes need to be filed soon, there’s an instant sense of urgency. The attached W2 file could be a genuine form that the attacker is hoping you’ll fill out and return, because it would give them information that may be used for further frauds and scams. Alternatively, the W2 may be a malware payload that’s triggered when you try to open the attachment.
A smart scammer might combine knowledge that the CEO is out of the office on a trip somewhere with tax season and send a request for all employee W2s, maybe with a message saying that they want to work on them during the flight they’re about to board and will hand off to the tax guy when they land. This information could be used for all sorts of fraudulent activity and identity theft, if not by the thief, then by other criminals they may sell the stolen data to.
What To Look For
There are a few reasons why BEC scams are so prevalent; chief among them is the fact that they actually work some of the time plus the potential rewards are substantial. No matter the level of sophistication, there are a few common themes and tricks that attackers use.
Understanding the mechanics behind a successful attack can educate you and your staff about what to be vigilant for.
Social engineering is all about emotional manipulation and it is an effective way to bypass your usual critical thinking skills.
With these BEC scams, there’s almost always a sense of urgency – the attacker wants you to respond before you think about it twice. They send emails with high importance flags and drop in deadlines. There might be the threat of not being paid on time, the risk of taxes being incorrect, or some other kind of anxiety that will irk you if you don’t respond quickly.
Attackers will spoof email addresses, and in some cases even use hacked email accounts. They will represent themselves as an organization you trust, or perhaps even a colleague. Messages that seem out of character or come in at strange times should be treated with suspicion. It’s also common for scammers to use domains that are highly similar to legitimate sources, but they may have one letter different in the middle, so scrutinize the sender address and look at URLs carefully.
If you stop to think about these scams and interrogate them, you’ll often be able to identify BEC attempts, but there’s no substitute for company-wide cultural awareness training.
Training for Security Awareness
It’s common practice to run annual security awareness training as part of a compliance checkbox spreadsheet, but if you want your employees to be properly armed in the fight against scams you need to train frequently. Flagging periods of higher risk, such as tax season, is a great way to reinforce and remind people of the training they’ve had. It doesn’t have to be in-depth technical training, but make sure they’re aware of major red flags related to social engineering.
Ultimately, if you can get employees to slow down and think before they act, that could be enough to help them identify a scam or refer suspicious emails to someone else who can investigate.
