{"id":6741,"date":"2016-09-12T09:44:39","date_gmt":"2016-09-11T23:44:39","guid":{"rendered":"https:\/\/www.backupassist.com\/blog\/?p=6741"},"modified":"2016-09-12T09:44:39","modified_gmt":"2016-09-11T23:44:39","slug":"business-e-mail-compromise-bec","status":"publish","type":"post","link":"https:\/\/www.backupassist.com\/blog\/business-e-mail-compromise-bec","title":{"rendered":"Business E-mail Compromise: Keeping Your Business Safe from BEC"},"content":{"rendered":"

Be really careful when you next get a message from your CEO, even if it’s from a legitimate address.<\/strong> It may not be from who you think it is.<\/p>\n

Over the last year and a half, small\u00a0to large businesses have been hit hard<\/a> by Business E-mail Compromise (BEC), also known as ‘CEO fraud’.<\/p>\n

BEC scams commonly involve targeting specific employees of an organization that appears to be from their CEO, asking for a wire transfer of funds to a nominated recipient. If you’ve got a\u00a0Chief Financial Officer (CFO), they’re most at risk of this sort of scam.<\/p>\n

<\/p>\n

How Does BEC Happen?<\/h2>\n

First, hackers compromise the CEO’s e-mail through phishing.<\/strong> If they can’t get your domain name, they’ll use a very similar one.<\/p>\n

For example, if your company’s domain name was “example.com”, they might register “examp1e.com” and send it to you. And if you’re a skim reader, you might miss it.<\/p>\n

Frequent targets of BEC\u00a0are organizations that regularly perform wire transfer payment. However, the fraudsters will usually use the method most commonly associated with your business’s normal practices, even if this is check.<\/p>\n

\"BEC<\/a><\/p>\n

If you’re hoping your spam filters will protect you against BEC, think again. It slips right through because thee e-mail is not\u00a0mass-mailed and targets a specific person. What’s more, it’s usually using a legitimate address. There’s no malware attached; only instructions.<\/p>\n

Some individuals reported being a victim of Scareware or Ransomware<\/a> intrusions immediately before a BEC\u00a0scam occured.<\/p>\n

The FBI reports<\/a> it has seen a 270%\u00a0increase in BEC scams since January 2015. It said from October 2013 to February 2016, losses have exceeded USD 2.3 billion.<\/p>\n

\"BEC<\/a>
Be Alert:<\/strong> Here you can see the address is made to look like the real one, with a single letter added.<\/em><\/figcaption><\/figure>\n

The Hackers Get To Know You<\/h2>\n

The real problem with a BEC scam\u00a0is that the perpetrators\u00a0get to know your business before they strike.\u00a0<\/strong>They research the target organization’s relationships, activities, interests, and travel or purchasing plans.<\/p>\n

They pull this off by scraping employee email addresses and information from your website. If they’ve got access to your inboxes, they’ll read all your mail before cooking up an e-mail, searching in particular for words to do with invoices, deposits, and your business infrastructure.<\/p>\n

Some BEC scammers will even go a step further and look for companies that have seen a change in leadership in the finance section, companies where executives are travelling, or by leading an investor conference call.<\/p>\n

On average, the FBI estimates<\/a> an organization hit with BEC\u00a0attacks lose between $25,000 and $75,000. Some attacks, however, have cost the victim companies millions or tens of millions of dollars.<\/p>\n

\"BEC<\/a>
Spoofed E-mail:<\/strong> Here, you can see the e-mail clearly didn’t come from the right source.<\/em><\/figcaption><\/figure>\n

<\/h2>\n

What Can I Do To Protect My Business Against BEC Scams?<\/h2>\n

The best safeguard against a BEC scam is\u00a0education. <\/strong>Train your staff in noticing the signs that might indicate a scam is taking place.<\/p>\n

Here’s what else you can do:<\/p>\n