How to Spot a Business Email Compromise (BEC) Scam

By March 2, 2020 Security
BEC Scams - How to Spot a Business Email Compromise Scam

Business email compromise (BEC) scams are on the rise. They target business owners and high-level employees in order to defraud a company, its customers, or its partners. In this type of scam, an attacker will pretend to be a trusted entity by spoofing a company email account. Then, they trick employees into revealing sensitive information or performing wire transfers.

Types of BEC Scams

There are different types of BEC scams. However, all these threats usually target employees with access to company finances, in an attempt to trick them into transferring money or revealing sensitive data. BEC scams include:

  • false invoice schemes (often posing as foreign suppliers)
  • CEO fraud (posing as a CEO or executive)
  • account compromise (attackers hack email accounts and use them to request payments)
  • attorney impersonation (email or phone calls from attackers pretending to be a lawyer or law firm representative)
  • data theft (targeting HR and bookkeeping employees to gain sensitive information about employees)

What can you do to detect or avoid BEC scams?

  • An email or phone call may happen when key personnel are absent or at the end of the day when your energy or attention is low. Attackers will try to take advantage of confusion, lack of knowledge, or fear with urgent statements, legal threats, and more. You should avoid clicking on any links in an email or replying. If it’s a phone call, hang up immediately. Speak to a supervisor or knowledgeable person about the issue.
  • Check that names and addresses are spelled correctly in an email header. Hackers will spoof legitimate addresses with slight changes. At a quick glance they look like the real thing. But when you look closely, you can see that a name has been misspelled or the email domain has an extra letter.
  • Even if an email comes from a trusted sender, confirm in person or over the phone before taking the action requested. Spear phishing emails are sophisticated and tailored to you, taking advantage of names that you trust and details about yourself.
  • If the request seems out of the ordinary or unusually urgent, always double check in person or over the phone with the requester. (And not by replying to the email!)

Technical Defenses

There are also technical steps you can take to defend your organization against BEC scams.

  • A strong anti-spam solution should flag emails based on rules. For example, it could flag emails where the “reply to” email address is different from the “from” email address. There are also intrusion detection system rules that can help flag fraudulent emails and domain names.
  • Payment verification requires additional two-factor authentication.
  • Confirmation requests for fund transfers, with phone verification or other two-factor authentication method.

And as always, a security aware culture begins with leadership and clear instructions. Reward employees for speaking up about their concerns and reporting possible attacks. Attacks and scams like business email compromises target people because humans are usually the weakest link – unless they are trained and educated about the latest threats.


Recent Posts / View All Posts

IT Leadership | Shared CIO

You Need IT Leadership

| Consulting, Leadership | No Comments
Missouri is just beginning to emerge from its stay-at-home order in response to the pandemic threat. Who ever imagined that pandemic planning policies would become a reality? What was once regarded as a threat with low probability of occurrence will likely become a much higher probability as we navigate through the coming years. The realization of this threat has certainly changed the way we view ourselves and the world around us. It has sensitized us to our newfound vulnerability. This month, I am writing to you from the Joplin, MO office of OXEN Technology. Considering our present circumstances, our physical…
Tech Tip Background

Office 365 Tip: Create a file request in OneDrive

| Office 365, Tech Tip | No Comments
If you need to obtain files from various people, you can use OneDrive to create a file request that allows others to upload documents directly to a folder you specify. This gives people a quick way to transfer files to you without giving them view or edit permissions to your OneDrive folder. Here’s how! Note: This feature is not available in Office 365 Government. For file requests to work, your Office 365 administrator must enable Anyone links in OneDrive. Requesting Files Using OneDrive Online, select the folder where you want others to upload their files. Click Request files on the…
Virtual Private Network

What is a VPN and do you need one to work from home?

| Security | No Comments
Since businesses started shifting to remote work due to COVID-19, OXEN has seen a sizeable uptick in requests for purchasing and implementing VPNs for at-home workers. You’ve probably seen that a Virtual Private Network (VPN) connection is often recommended for securely working from home while accessing company resources. So what’s a VPN for in this context, and do you need one? If you’re a business manager, do you need a VPN connection for every employee who’s now working from home? Read on for our tips. What Is a Virtual Private Network? VPN stands for “Virtual Private Network”. It creates a…