With great power comes great responsibility. Technology has empowered us in so many ways, ranging from real-time online banking to collaborating on business centric tasks. But it is no secret that the convenience and productivity boost that technology provides comes with the potential for malice resulting from the criminal intent of bad actors.
That’s why it’s up to us and the organizations we interact with to not only practice vigilance but to proactively implement best practices, ensuring we’re utilizing all the safeguards at our disposal.
What is Business Email Compromise (BEC)?
BEC is a type of cyberattack where threat actors impersonate trusted parties of a business (e.g., executives, assistants, attorney, bankers, staff, etc.) to redirect funds or extract sensitive information. These attacks are sophisticated, discrete and highly personalized. Threat actors typically use impersonation to target victims with convincing and fraudulent tactics.
Most times, they aim to:
- Gain access to a trusted email account (often via phishing or password reuse)
- Monitor email threads, study communication patterns, identify financial workflows and map out decision-makers
- Insert a well-timed, well-worded and time-sensitive payment or data request
- Make their fraudulent request resemble ongoing work, appearing familiar with routine processes and stakeholders
What can you do protect against BEC?
Often times, there are no obvious red flags and victims may not even be aware that a successful cyberattack was carried out. However, BEC attacks are not inevitable.
What You Can Do:
| Be Wary Of: |
Consider Safeguard Behaviors: |
|---|---|
|
Unusual urgency or secrecy |
Don't trust emails that create a sense of urgency, threaten or pressure you to act quickly. Phishing emails often use this tactic to make you act without thinking. |
|
Last-minute changes to payment details |
Pause and reflect for high-dollar decisions (e.g., revalidate information). Contact a member of your relationship team if you are unsure. |
|
Email communication only; refusal to verify |
Remember, if in doubt, contact a member of your relationship team. A second factor of authentication is always welcome to verify the identity for financial transactions. |
|
Misspellings of domain, sender variation or unusual sender |
Always check the sender's email address and domain name or phone number. If they don't match the name, number or organization of the sender, or if they contain spelling errors or unusual characters, be suspicious. |
|
Bypass requests for normal procedures or controls |
BNY has standards and procedures to keep you and your account safe. Treat any messages directing staff to ignore standard payment protocols or skip approvals as suspicious. |
|
Indicators of Account Compromise |
Monitor your accounts for unusual activity. Set up notifications and leverage multiple factors to verify identity to online accounts. |
Additional Security Guidelines to Protect Against BEC
- Multi-factor authentication (MFA) on all professional email accounts wherever able. MFA adds an additional layer of security, reducing the risk of unauthorized account access.
- Don’t auto-forward emails or give others access to your email unless it is approved and documented.
- Leverage callback procedures to verify financial transactions. Independent confirmation through a callback can prevent unauthorized fund transfers.
- Be aware of the latest cybersecurity trends. Knowledge of the latest threats and protective measures can help you avoid potential scams.
- Avoid sharing account logins between individuals, assistants, or family members.
- Routine monitoring of financial transactions. Regular reviews can detect anomalies and prevent fraudulent activities.
Asset Recovery: Immediate Considerations
If you have been hit by a BEC attack and funds have been transferred, time is critical. Consider the following to increase your chances of asset recovery.
Documentation & Consultation
Gather all documentation regarding the transaction and emails/invoices received. Consider consulting a civil lawyer in the country where the money was deposited into the beneficiary bank account. This might be of help when working with the bank to try and recover the money and/or launching a civil complaint regarding the account holder.
Financial Institution Notification
Contact your relationship team for guidance and assistance.
