According to the FBI, BEC is one of the most financially damaging online crimes. It’s a form of social engineering when attackers manipulate victims into giving up information or making payments by posing as trusted contacts. These scams often begin with a legitimate-looking email that appears to come from a CEO, vendor, or business partner.
Here’s how it works:
- A fraudster gains access to or spoofs a legitimate business email account.
- They send convincing emails requesting changes to payment instructions or urgent transfers.
- These emails often bypass spam filters and don’t include malicious attachments, making them harder to detect.
- By the time fraud is discovered, the money is often gone.
Why BEC Works
Cybercriminals play the long game. They often monitor email exchanges, learn the roles of employees, and wait for the perfect opportunity, like when an executive is traveling or a finance employee is under pressure, to strike.
Common BEC Tactics Include:
- Fake invoices from a known supplier
- Requests for gift card purchases
- Impersonation of executives asking for urgent wire transfers
- Domain spoofing to create lookalike email addresses
- Compromising personal email accounts used for business
How to Protect Your Business
- Enable Multi-Factor Authentication (MFA) – It’s a simple but powerful layer of protection.
- Verify Requests Offline – If a payment or account change is requested via email, confirm it with a quick call or in-person check.
- Train Your Team – Regular cybersecurity training helps employees spot red flags and respond appropriately.
- Segment Financial Duties – Implement checks and balances for wire transfers and payments.
- Review Email Rules – Criminals often set up auto-forwarding or filtering rules to hide their activity.
- Invest in Cybersecurity Tools – Advanced email filtering, monitoring, and endpoint protection can help detect suspicious behavior.
Been Compromised? Act Fast.
If you suspect your business has fallen victim to a BEC attack:
- Contact your bank immediately to request a recall of the wire transfer.
- File a report with the FBI’s Internet Crime Complaint Center (IC3) at www.ic3.gov.
- Notify your IT team or cybersecurity provider to investigate and contain the threat.
Don’t Let Your Inbox Be the Weak Link
At Higher Information Group, we help businesses of all sizes strengthen their defenses. From managed IT and endpoint protection to user training and secure email systems, our Technology Solutions team can help safeguard your operations.
Need to review your cybersecurity setup? Let’s talk.
