One of the most convenient and cheapest communication channels is email. At the same time, it is an attractive platform for cybercriminals activities. Modern attacks easily bypass traditional defense methods. Therefore, one of the main tasks in ensuring company security is the reliable protection of email.
Business email compromise – confidential information compromise by deception and for the purpose of obtaining financial gain. Such crimes are considered the costliest at present, surpassing even ransomware attacks.
Principle of operation
The main methods used by cybercriminals are direct account hacking and social engineering methods.
These methods include:
- Keylogging – using keyloggers (software that tracks or logs keystrokes), cybercriminals gain unauthorized access to mail accounts. Such software, by monitoring keystrokes, reading data from the clipboard and / or creating screenshots, can capture the user’s password. The malware is downloaded using a phishing email that contains a keylogger.
- Spear phishing – using a fake email, a cybercriminal obtains confidential information from a specific company employee. Spear phishing attacks are often used by criminals to obtain personal and sensitive medical information.
Business email compromise types
- Fake invoice – from a fake account, a cybercriminal sends a fraudulent invoice to a company demanding payment to an unfamiliar bank account;
- Management scam – a cybercriminal hacks into the account of someone from the company’s top management and, posing as an employee, requests a payment from the finance department to an unfamiliar bank account;
- Account compromise – a cybercriminal hacks into an employee’s account, sends fraudulent invoices to suppliers and requires payment to be made to his account;
- Legal representative scam – the cybercriminal poses as a legal representative (for example, a lawyer), contacts victim, asks him/her to act immediately and forces him/her to transfer funds to the criminal bank account to solve the problem;
- Data theft – a cybercriminal hacks into the account of a certain employee (for example, from the human resources department) and requests the personal information of other employees in order to carry out a larger and more destructive attack.
How to prevent business email compromise?
- Staff training – thorough all emails screening, especially with internal and external requests for sensitive data. Signs of a potential mail compromise attempt: unusual request from a colleague, including senior management, errors and incorrect use of language, inconsistencies in font type and size, typos, requests that do not follow the usual protocol, a requirement to keep correspondence confidential;
- Multi-factor authentication implementation – this will add an additional layer of data protection. This authentication method often uses a password with the requirement to verify the identity by other ways (for example, biometrics, etc.). Having passed the first level, criminals are unlikely to be able to log in;
- Preventing Typesquatting – companies can prevent an entry point by registering very similar (mistakenly) domains;
- Email verification implementation – mail verification methods help filter, block and alert suspicious emails;
- Development of an effective security system – a reliable control system greatly complicates the system hacking;
- Limiting the public display of personal information – cybercriminals use information from public sources to reveal more important information using social engineering.
