Business Email Compromise (BEC) is an advanced evolution of traditional email phishing. Instead of generic mass mailings, this fraud is characterized by being more specific and targeted. Attackers use impersonated or compromised corporate accounts to send emails that appear legitimate to mislead employees, usually for financial gain.
Often, attackers present themselves as a superior requesting urgent action. The request is usually confidential, with instructions not to share the information with others in the organization and to justify the urgency to avoid the usual checking procedures.
How is a BEC attack carried out?
Compromise of the email account: This can be accomplished by obtaining the credentials of a real account or by modifying the domain of a legitimate account so that the differences are unnoticeable to the naked eye.
For example:
user@domain.com
user@dornain.com
The “m” in “domain” is changed to the letters “rn”, which may go unnoticed to the naked eye.
Contact via the spoofed account: Cybercriminals send emails pretending to be an authority figure within the company, requesting confidential information or changes to sensitive data, such as bank accounts. To make the request more credible, attackers sometimes make prior requests (such as asking for documentation) before requesting more compromising actions, such as fund transfers. It is important to note that this initial information can be used for later frauds.
Possible use of malware: Although BEC attacks do not usually require malicious software, in some cases they may include links or files containing malware that allow them to access corporate systems undetected.
Most common types of BEC attacks
CEO fraud: The attacker impersonates a senior executive (CEO, CFO, etc.) and requests an urgent transfer to an account controlled by the cybercriminals or requests sensitive information.
Supplier fraud: The attacker pretends to be a trusted supplier and asks to modify the bank details where payments are to be made, thus diverting funds to fraudulent accounts.
HR fraud: Attackers impersonate an employee and ask Human Resources to change the account number where payroll is deposited, redirecting the salary to an account controlled by the criminals.
How to protect yourself?
BEC does not attack technological systems directly, but uses psychological manipulation techniques to make the people involved act rashly. Therefore, before any unusual or urgent request, it is advisable:
Verify the authenticity of the sender through an alternative channel, such as a direct phone call.
Carefully review the e-mail address, looking for slight modifications in the domain.
Implement clear policies for handling transfers and changes to confidential data, including a second verification by another team member.
Raise employee awareness through regular training on how to identify this type of fraud.
Maintaining a preventive attitude and clear internal communication is key to minimizing risks.
Sources:
Cookie settings
