Essentially, Business Email Compromise (BEC) scams consist of cybercriminals impersonating individuals or entities within their targets’ trusted networks for malicious gains. These scams are categorized as a form of social engineering, which refers to a broader cyberattack method that preys on key human behaviors (e.g., trust of authority, fear of conflict and promise of rewards) to obtain unwarranted access to organizational systems, funds or data. While the specific methods utilized for executing BEC scams can vary, these incidents often follow the same general framework. Here are the main steps a cybercriminal takes when deploying a BEC scam.
First, a cybercriminal selects an organization to launch their BEC scam against. From there, the cybercriminal will conduct a range of research on the organization to help them develop a detailed profile of the company and its executives, create convincing emails and gain their target’s trust during the attack. This research may include activities such as the following:
After researching the organization, cybercriminals will use the information they collected to prepare for their attack. At this point, the cybercriminal picks a specific individual within the organization as their main target for the incident, likely someone who has access to critical company funds and data.
Once they choose their target, the cybercriminal will deploy malicious software (also called malware) to access their target’s email account, monitoring the target’s digital interactions for days or weeks without their knowledge. Doing so allows the cybercriminal to see who the target frequently interacts with, what their conversations typically look like and the types of activities they conduct via email (e.g., paying invoices or sharing sensitive company files). The cybercriminal can then use this information to better impersonate a trusted sender and manipulate the target.
What’s more, the cybercriminal may also hack into the email account of another individual in the target’s organizational network, inserting themselves directly into legitimate conversations and further convincing the target to engage in compromising activities. Here are some other common attack strategies the cybercriminal may use:
Once the cybercriminal convinces their target that they are engaging in a genuine business interaction, they will conclude the attack by manipulating the target into wiring company funds to the cybercriminal’s personal bank account or a bank account controlled by a large-scale organized crime group; sharing sensitive organizational details, intellectual property, supply chain information or workplace documentation; providing account credentials; or disclosing confidential employee or customer data.
BEC scams have become a pressing concern for all businesses, regardless of size or industry. With these incidents on the rise, businesses simply can’t afford to ignore their BEC exposures. Nonetheless, by implementing effective prevention, response and recovery procedures, businesses can not only limit their likelihood of experiencing such incidents but also mitigate possible losses when attacks arise.

Above all, it’s crucial for businesses to understand that they aren’t alone in managing their cyber risks and safeguarding against BEC scams. There is a wide range of resources and guidance available from trusted experts and professionals. For more information, contact Vista Insurance Group today.
Source: Zywave
5643 Harrisburg Industrial Park Dr.
Harrisburg, NC 28075
Licensed Insurance Professional. Respond and learn how insurance and annuities can positively impact your retirement. This material has been provided by a licensed insurance professional for informational and educational purposes only and is not endorsed or affiliated with the Social Security Administration or any government agency. It is not intended to provide, and should not be relied upon for, accounting, legal, tax or investment advice.
Licensed Insurance Professional. Respond and learn how insurance and annuities can positively impact your retirement. This material has been provided by a licensed insurance professional for informational and educational purposes only and is not endorsed or affiliated with the Social Security Administration or any government agency. It is not intended to provide, and should not be relied upon for, accounting, legal, tax or investment advice.