By J. Mesa
A bookkeeper gets an email from a longtime vendor. The vendor has changed banks, the message says, and future payments should go to a new account. The email looks right. The bookkeeper updates the record and pays the next invoice. Weeks later the real vendor calls to ask about the overdue payment.
That is business email compromise. It needs no malware, and it costs businesses more than any other online crime reported to the FBI.
What is business email compromise?
Business email compromise (BEC) is a scam in which a criminal uses email to pose as someone you trust, such as an owner, an executive, a vendor, or an attorney, and asks an employee to send money or sensitive information.
The message may come from a look-alike address or from a real account the criminal has taken over.
How does a BEC scam work?
- Research. The criminal studies your website and social media to learn who handles payments and who your vendors are.
- Access or imitation. They break into an email account through phishing, or they register a domain one letter off from the real one.
- Watching. Inside a mailbox, they read invoices and learn how people write.
- The request. They send a payment request or a change in bank details at a believable moment.
- The transfer. The money goes to an account they control and moves again within hours.
What are the common types of BEC?
- Vendor or invoice fraud. A fake notice that a supplier’s bank details have changed.
- CEO fraud. A message from “the owner” asking for an urgent wire.
- Payroll diversion. A request to change an employee’s direct deposit account.
- Gift card requests. “The boss” needs gift cards for clients right away.
- Attorney impersonation. A message about a confidential deal that requires a fast payment.
- Real estate fraud. Fake closing instructions sent to a buyer.
- Data theft. A request for employee W-2 forms or customer lists.
Why does BEC work?
- It uses trust in people you know
- It arrives during real transactions
- It contains no malicious link or attachment for a filter to catch
- It creates urgency and asks for secrecy
- Employees want to be helpful and fast
What are the warning signs?
- A change in bank account or payment details
- Pressure to act today
- A request to keep the matter confidential
- A sender address that differs by a letter or uses a different domain
- A reply-to address that differs from the sender
- A request outside the normal process
- Writing that sounds unlike the person
- A message that says the sender can’t take calls
How much does BEC cost?
The FBI’s Internet Crime Complaint Center reports losses from BEC in the billions of dollars each year, more than ransomware by a wide margin. A single incident at a small business can run from a few thousand dollars to several hundred thousand.
How do I prevent BEC?
Technology helps, and process stops it.
- Verify by phone. Confirm any new or changed payment details by calling a number you already have on file. Never use the number in the email.
- Require two people to approve wire transfers and new payees.
- Set a waiting period for payments to a new account.
- Turn on multi-factor authentication for all email accounts.
- Train your staff to recognize these requests, with real examples.
- Limit what you publish about who handles finance.
- Review mailbox rules. Attackers create forwarding rules to hide their activity.
What technical controls help?
- SPF, DKIM, and DMARC records on your domain, which make it harder to send email that appears to come from you
- External sender warnings that flag messages from outside your company
- Email filtering with impersonation protection
- Alerts for new forwarding rules and logins from unusual locations
- Registration of look-alike domains, so criminals can’t use them
What is the single most effective control?
The phone call. A two-minute call to a known number defeats almost every version of this scam. Write it into your payment procedure, and make it mandatory for every bank detail change, no matter who asks or how urgent it sounds.
What should I do if I sent money to a scammer?
Move fast. Recovery depends on hours.
- Call your bank at once and ask for a recall of the wire or a reversal of the transfer.
- File a complaint with the FBI at ic3.gov. Include the bank and account details of the recipient. The FBI can sometimes freeze funds when a report arrives soon after the transfer.
- Change the passwords on the affected email accounts, and check for forwarding rules.
- Notify your cyber insurer and your attorney.
- Tell the vendor or person who was impersonated.
- Keep the emails. Don’t delete evidence.
Can I get the money back?
Sometimes. The chance is best when you report within a day or two, before the money moves overseas. After that, recovery becomes unlikely. Speed is the reason every employee should know who to call.
Does cyber insurance cover BEC?
Some policies do, often under a “social engineering” or “funds transfer fraud” section with its own lower limit. Many require proof that you followed a verification procedure. Read your policy and ask your broker before you need it.
How do I protect my customers from criminals posing as me?
- Set up DMARC on your domain
- Tell customers that you will never change bank details by email alone
- Put that statement on your invoices
- Give customers a phone number to verify any request
How is BEC different from phishing?
Phishing casts a wide net and aims to steal credentials or install malware. BEC targets one person in one business with a request for money. Phishing often comes first: a stolen email password gives the criminal the mailbox they use for the BEC attempt.
How often should I train staff on BEC?
Train everyone who touches money at hire and at least once a year, and send a reminder before busy periods such as year end and tax season. Include the owner. Criminals impersonate the owner because staff hesitate to question the boss.
Your next step
Write one rule into your payment process today: every change in bank details gets a phone call to a known number. Cerberus Cybersecurity can train your finance staff and document your payment controls through our cybersecurity training and policy development. Contact us to protect your business from invoice fraud.