Business Email Compromise
Business Email Compromise (BEC) costs organizations billions annually. These sophisticated attacks use social engineering rather than malware, making them difficult to detect with traditional security tools.
How BEC Works
Account Compromise
Attackers gain access to legitimate email accounts through:
- Credential phishing
- Password spraying
- Purchasing stolen credentials
- Session hijacking
- Spoof email addresses
- Register look-alike domains
- Use free email services
- Exploit display name trust
- Multi-factor authentication
- Email authentication (DMARC)
- Advanced email filtering
- Account compromise detection
- Suspicious activity alerts
- Out-of-band verification for payments
- Dual approval for financial changes
- Vendor verification procedures
- Payment confirmation calls
- Executive-focused training
- Finance team training
- Simulated BEC exercises
- Real-world examples
Impersonation
Without account access, attackers:
Common BEC Schemes
Wire Transfer Fraud
Impersonating executives to authorize fraudulent payments.
Invoice Manipulation
Modifying legitimate invoices with attacker bank details.
Payroll Diversion
Requesting changes to employee direct deposit accounts.
Gift Card Scams
Requesting purchase of gift cards for “confidential” purposes.
Prevention Strategies
Technical Controls
Process Controls
Awareness Training
Response
If BEC occurs:
Contact our team for BEC protection.