Why Enterprises Continue to Be at the Mercy of BEC
Business Email Compromise (BEC) continues to deceive people into believing they are interacting with a trusted sender. Unfortunately, by gaining trust, the cybercriminal can transfer funds to their accounts, gain access to sensitive data, or other ill-intended actions with great success.
BEC attacks are cunning and when combined with human error, are so successful the FBI labeled them “one of the most financially damaging online crimes.” Traditional email security practices of focusing on content and infrastructure analysis will not work BECause threat actors' tactics are constantly evolving within business and individual user environments, so it’s not enough to keep up with the latest malicious tactics—you need to stay one step ahead.
Stages of a BEC Attack
Business Email Compromise comes in many forms. These are sham security alerts, last-minute payment requests, bogus past-due statements, fraudulent wiring instructions, and more. BEC and phishing scams continue to be the primary attack vectors into organizations—and in 2021 alone, over $44 million in losses were a direct result of successful phishing campaigns and social engineering scams.
PHASE 1: Preparation
Build Target List
Cybercriminals start by building a target list, often using business contact databases, mining LinkedIn profiles, and even scouring the target's website to identify key individuals and relationships.
PHASE 2: Execution
Launch Attack
Attackers launch BEC campaigns, sending email to their targeted list. BEC attacks have no malicious payload and will use impersonation tactics like display name deception, spoofing, or lookalike domains to compromise your account.
PHASE 3: Deception
Apply Social Engineering
To convince the victim to take action, attackers impersonate people of authority, such as the CEO or CFO, and express urgency within the request.
PHASE 4: Action
Reap Rewards
With trust, authority and urgency established, the victim proceeds with the request. Unfortunately, the results can end with great financial loss or a colossal data breach.
How Fortra Defends Against Business Email Compromise
Monitors for Email Authenticity
Focusing on content and infrastructure analysis doesn’t work against BEC, since no malicious payloads are used and they can be launched via reputable email services.
This is why Fortra's Cloud Email Protection platform carefully inspects each incoming email and spots the anomalous BEC behaviors, preventing attacks from reaching the inbox.
Automates Partner & Supplier Fraud Prevention
Cybercriminals often pose as a trusted supplier or partner in order to conduct invoice fraud, real estate scams, or other common BEC attacks.
Fortra's Cloud Email Protection leverages a collection of machine learning models to evaluate relationships and behavioral patterns between individuals, brands, vendors, and domains using hundreds of characteristics to detect malicious emails.
Prevent BEC Attacks with Advanced Features
Business Email Compromise Solutions
Protect Your Organization from Costly Advanced Email Attacks
The biggest benefit we got from deploying Fortra's solution was visibility. We got visibility into the attack space and into how inconsistent some of our enterprise controls were applied.
Bill Burns, Chief Trust Officer, Informatica