Business Email Compromise (BEC)

Business Email Compromise (BEC) is a type of phishing or social engineering attack that primarily targets senior executives and finance department staff. The malicious party launching the attack impersonates someone with decision-making authority, likely someone who can authorize a financial transaction, provide system access, or release sensitive data. 

Since many organizations rely on email for internal communications, often, no one suspects the email is a phishing attack. If email security is not adequate, the attack may never be identified.  

email is a phishing attack. If email security is not adequate, the attack may never be identified. 

The cost and implications of the Business Email Compromise (BEC) in recent years have become increasingly concerning. For example, according to an FBI report, BEC alone resulted in almost $2 billion in losses in 2019. In another report, the agency claimed that identified global losses have increased by 65% from July 2019 to December 2021. It is no wonder that organizations are bolstering their security to confront the rising specter of BEC. 

But what is the goal of the Business Email Compromise (BEC)? How can you spot the different forms of BEC attacks and protect your organization?

The main goal of a BEC attack is to steal money, gain system access, or compromise sensitive data by deceiving the recipient into thinking they have received a legitimate email from someone with authority. BEC attacks are launched in the hope that senior staff members use email to authorize actions, so the message does not raise suspicions.

As the public became more aware of BEC scams and more organizations implemented safeguards to improve their security posture, scammers responded by evolving their methods. Here are some of the principal methods BEC criminals now use:

In this type of attack, the perpetrator impersonates a “trusted” vendor and requests payment for services or products. The content of the message, the supposed sender, and the email format may look genuine, but the payment information is false and funds are fraudulently misdirected.

This type of BEC attack impersonates a company's CEO or another top-rank executive. The attacker asks the recipient to perform a specific action, usually either to authorize a payment, allow system access, or reveal sensitive data to another partner or associate.

This type of attack can only take place if an actual account is compromised. Rather than “spoofing” an email account, the scammer has access to a genuine account and misuses it to request payment or gain further access to a network or system.

This type of attack takes advantage of people who will likely respond to a request from an attorney or legal representative. It impersonates an attorney and usually targets low-level employees. The attacker typically labels the message as time-sensitive, urgent, or confidential, improving the chances that the recipient will act on it without scrutiny.

In this type of attack, the hacker impersonates someone in the finance or HR department, and the goal is to access sensitive employee or customer data to sell or misuse.

Over the years, BEC attacks have taken a heavy toll, and the costs continue to rise as the attacks become more varied and complex. Consider these statistics:

1. The FBI logged almost 24,000 BEC attack complaints in 2019, with losses totaling $1.7 billion.
2. Between 2019 to 2021, global losses from BEC attacks increased by 65%.
3. Between 2013 and 2021, BEC attack victims in the U.S. suffered losses amounting to almost $15 billion.
4. In 2020 alone, 65% of businesses experienced BEC attacks.

One of the biggest BEC scams ever, this scam resulted in losses of about $121 million over a two-year period. The perpetrator and his associates set up a fake company with the same name as a genuine supplier. Then they issued invoices to Google and Facebook, which were then paid. The bank accepted the transfers due to fake contracts and documents provided by the fake company.

In 2019, a Toyota subsidiary was targeted by a BEC attack that ended up costing the parts supplier $37 million. Hackers convinced an employee to transfer the money long before the attack was detected.

One Treasure Island, a nonprofit based in San Francisco, was the target of a BEC attack that cost them over $600,000. The hackers compromised the email account of a third-party bookkeeper and manipulated an invoice, resulting in a loan intended for a partner organization to be transferred to the criminal’s bank account.

In 2020, a high-level government employee was duped into transferring $2.5 million to a fraudulent bank account. This happened after receiving an email from another government employee—whose email account hackers compromised and used—informing them of a change in the banking details for remittance payments. The money was then transferred to the “new” bank account.