What is it?
Business Email Compromise (BEC) is a type of targeted phishing, or ‘spear phishing’. This is when cybercriminals create fake emails, or infiltrate legitimate emails, to scam businesses.
Email is a common entry point for cyberattacks, as criminals can pretend to be a trusted contact: you receive a suspicious email from someone you know, but they didn’t really send it. The email might request payment for an invoice, ask to change bank account details, purchase gift cards, or share credentials.
It’s important to question this!
Common Types
- Invoice fraud: Cybercriminals hack supplier’s email accounts and gain access to real invoices. They then edit contact and bank details on the invoices, and send them out to customers from the compromised email account. Since the sender and invoice seems legitimate, the customer pays the invoice as normal, but the money gets sent to the wrong bank account.
- Employee impersonation: Cybercriminals hack into work email accounts to impersonate a co-worker or boss. Spoofing is where the contact’s name shows up normally, but the email address is very clearly wrong.
- Company impersonation: Cybercriminals register a domain with a name very similar to a known organisation, in order to use the company’s reputation to their advantage. For example, an email sent from ‘[email protected]’ with a link to reset a password, or ‘[email protected]’ trying to verify or update your information.
Protect Against BEC
- Check the spelling of details, and compare it to previous legitimate correspondence
- Make sure your IT provider has a robust spam filter in place
- Never provide personal data, like usernames or passwords, when you receive unprompted communications
Good Practice
- Set up multifactor authentication for all logins
- Use strong passwords or passphrases, and make sure they’re all unique for each account
- Double check with the person or company sending the request or information that what you have received is correct
Concerned?
If you think your emails have been compromised, or you aren’t sure, please advise your IT support and make a report with the Australian Cyber Security Centre (ACSC).
You can learn more from the ACSC about BEC here.
