Imagine receiving a work email from your finance department asking about an overdue invoice. You notice it has a few extra typos and uses strange language, so disregarding it as junk. What you don’t know is that your very busy coworker receives the same email at the same time. Because they’re more distracted than normal, they respond, unknowingly aiding with a business email compromise (BEC) attack.
While this seems like an unlikely scenario, BEC attacks are among the most lucrative online crimes, and according to the FBI, financial losses due to BECs have increased nearly 58% since 2020. As email scams and malware become more sophisticated, more companies are finding themselves susceptible to email-based attacks. In this article, we explore the right prevention and response measures you can implement to protect your most valuable data.
What is a Business Email Compromise Attack?
A business email compromise attack occurs when a bad actor uses email to trick someone into sharing sensitive or confidential information. Phishing, spearphishing, and email domain spoofing are all common types of email attacks, and according to the FBI, they’re some of the most financially damaging online crimes businesses can face.
In a common scenario, an employee might receive a convincing email from a seemingly trustworthy source, such as a third-party vendor requesting a wire transfer or a manager asking the team member to spend money on their behalf. They may not realize that a scammer could use fake email accounts or malware to infiltrate the company network.
How To Prevent a Business Email Compromise Attack
While it requires more upfront investment, prevention measures can prevent you from costly data recovery and the security updates you’ll have to make in the wake of a fraudulent email attack. Here are some of the most straightforward, effective solutions you can implement immediately for better security.
Use Email Monitoring Software
Using email monitoring software to track and index all incoming and outgoing emails is one of the most proactive measures you can take against an email compromise attack. Not only can it give you insight into how much time staff members spend on your company’s email app, but a cybersecurity platform like Teramind also lets you set specific alerts for suspicious email content, senders, and subjects. It will also block any outgoing emails based on security parameters you set, automatically alerting you when that happens.
Implement Data Loss Prevention Tools
Data loss prevention (DLP) tools give companies more control over their sensitive data and intellectual property by blocking it from unauthorized data sharing or downloading. Businesses and organizations looking for comprehensive protection may want to invest in a full range of DLP options, like:
- Endpoint DLP: This allows you to monitor and secure data on endpoint user devices like laptops, desktop computers, and mobile devices.
- Cloud DLP: This protects any sensitive information that may be flowing through your third-party vendors cloud systems. If your company uses Microsoft 365 or Google Workspace to host your email accounts, then this type of DLP might be a good fit for you.
- Network DLP: This is another great option to protect against malicious emails as network DLP solutions can monitor
- Storage DLP: This type of loss prevention protects data you store in file servers, databases, and data warehouses.
Use Secure Email Providers
Secure email providers use end-to-end encryption, which means that a bad actor cannot intercept the email on the sender or recipient side. Typical email platforms like Gmail may not be sufficient because they can’t guarantee that the email remains secure on the receiver’s end.
But with secure email providers like ProtonMail, HubSpot, or ZohoMail, not even the providers themselves can read your emails, ensuring that the only one who’ll see the email content is the intended recipient.
Teach Employees How To Identify Scams
Phishing attacks can still occur even with the right tools and platforms. That’s why it’s essential to supplement your prevention tech with team member education. Make sure team members know to scan company emails for:
- Suspicious links or attachments like convincing-looking invoices
- Unexpected or unusual requests, particularly for account information or login credentials
- Mentions of fake company names that are spelled similarly to legitimate ones
- Language that expresses a sense of urgency or fear
- Unusual typos and slight variations in the email address or way the sender expresses themselves
Setup Regular Email Password Resets
One way to protect company emails from being hijacked by the wrong people is to reset all email passwords every few months. This limits the amount of time a malicious actor can spend infiltrating your system. It also has the added benefit of making employees aware of the reality of BECs so they can make more informed choices when reading their emails and help prevent future attacks.
Implement Two-Factor Authentication (2FA)
Multi-factor authentication requires employees to confirm their credentials with two or more verification options, like their email password and a temporary code they receive on their phone. Suppose you elevate your company’s email authentication standards and ask them to complete this process whenever they log in to their email. In that case, you’ll increase the amount of barriers a scammer has to overcome to access sensitive company information.
How To Respond to a Business Email Compromise Attack
Don’t wait for a BEC attack to happen before you have a response plan ready. Make these best practices part of your go-to strategies for addressing email scams before they happen.
Incident Response and Reporting the Attack
It’s essential that employees know always to notify someone if they receive a strange email rather than just ignoring it. But you should make sure they know who to report to.
That’s why it’s best to have an anonymous reporting portal or form that team members can fill out if they experience any anomalous behavior at all, even if it occurs via another channel. Ensure this online form prompts employees to share the potentially compromised accounts, the nature of the incident, potential impact, and any evidence they have to share.
Alert Law Enforcement Agencies
When you have evidence of a BEC, contact your local police department and ask to file a report. You should also contact your bank to flag your business accounts for any suspicious financial transactions.
Suppose your local police department isn’t equipped to handle an online attack. In that case, you can also complete a report with the FBI’s Internet Crime Complaint Center (IC3) or forward your suspicious emails to the Department of Homeland Security’s Computer Emergency Readiness Team (US-CERT).
Strengthen Cybersecurity Strategy and Defenses
Health, government, and financial institutions are all responsible to clients and regulatory agencies like HIPAA, FISA, or PCI to implement robust cybersecurity and data protection measures. But the reality is that all businesses have vulnerable data that could be compromised in an email attack. That’s why more security teams should consider cybersecurity defense solutions like:
- Vendor risk assessments — Vet any third-party vendors or businesses with whom you plan to communicate via email before starting a long-term business relationship.
- Stricter email controls — Configure your privacy controls to prevent team members from sharing sensitive information to someone with unauthorized access.
- Internal email risk reviews — Conduct an audit of your business’s current email authorization and data sharing workflows, checking for gaps in your internal security.
Train Employees on Security Best Practices
Well-informed staff members are among your strongest security resources and are often your last defense against a BEC attack. That’s why you should make sure they’re educated about:
- Social engineering techniques — Employees may not be aware of social engineering tactics, in which malicious insiders or scammers create false pretexts or make quid pro quo offers to manipulate them into participating in a cyber attack. Share examples of BEC with them so they can keep an eye out for suspicious emails.
- How to handle links and attachments — Make sure team members know to always hover over URLs and attachments before opening to ensure they don’t unwittingly click on malicious links or open malicious attachments.
- Your company policies and procedures — Make sure employees are thoroughly onboarded from the beginning and know, for instance, your company’s standard process for money transfers so they’ll never fall prey to a fraudulent invoice request.
Implement a UEBA Solution
A user and entity behavior analytics (UEBA) solution allows you to monitor how your employees interact with your system and detect any suspicious activity based on the parameters you set. This allows you to predict and prevent data loss and phishing attacks long before they happen.
For instance, a UEBA platform like Teramind can detect when employees sign in during off hours, download or upload large amounts of information, visit suspicious websites, and even identify if someone with unauthorized access has infiltrated your network.
The great thing about using a UEBA platform is that it can help you defend against various cyber threats, including a malware campaign or a malicious internal employee. It also saves you money by reducing your reliance on IT analysts and by preventing costly data breaches.
Label External Emails
Most email security providers can automatically mark any email that’s been sent from outside your organization. This is an especially helpful tool for busy or potentially distracted team members who may not think to check for an email address mismatch before checking the email content. On top of that, a high-quality email security tool can also offer powerful spam filters and integrated anti-virus software.
Conclusion
It takes a combination of the right processes, tools, and employee training to protect yourself from a BEC attack. If you’re proactive, you can head the worst email-related attacks off at the pass or minimize the damage bad actors can inflict. And with a comprehensive platform like Teramind that can monitor and block unusual activity across your entire organization’s emails, internal network, cloud services, and other vulnerable touchpoints.
FAQs
What are some identifiers of a BEC attack?
Some identifiers of a BEC attack include requests for urgent wire transfers, changes to payment instructions, spoofed email addresses, and pressure to keep the request confidential. Detection and prevention of these indicators are crucial to mitigating the risks associated with a business email compromise attack.
How is a BEC attack different than a typical phishing email?
A BEC attack differs from a typical phishing email in that it specifically targets businesses and impersonates trusted individuals or companies to manipulate employees into transferring funds or providing sensitive information. While phishing emails cast a wider net, BEC attacks are more targeted and sophisticated, often utilizing social engineering techniques to deceive victims.
How does a BEC attack work?
A BEC attack is different from a typical phishing email because it typically targets specific individuals in an organization, and the attacker often impersonates a high-level executive or business partner to gain their trust. The attackers typically use social engineering techniques to trick the targeted individuals into transferring funds or providing sensitive information.
Who is most often targeted in BEC attack-style emails?
Business email compromise (BEC) attacks typically target individuals with financial responsibilities, such as CFOs, accountants, or employees authorized to make payments or access sensitive information. These attacks involve hackers impersonating legitimate senders and tricking recipients into wiring money or divulging confidential data.
Who do BEC attacks typically target?
BEC attacks typically target employees with attack-style access to company finances or sensitive information, such as CFOs, accounting personnel, or executives. These attackers use social engineering tactics to manipulate their targets into transferring funds or sharing confidential data.
What is the first stage of a BEC attack?
The first stage of a BEC attack is typically reconnaissance, where the attackers gather information about their target. They may research the organization, its employees, and its business practices to craft personalized and convincing emails to deceive the target.
