Talk to an Expert
Search
Close this search box.
Talk to an Expert

Business Email Compromise (BEC)

How to protect against, detect or recover from it.

Australian companies lose an average of $50,673 per attack

BEC is a fraud technique in which offenders redirect legitimate fund transfers over to alternative accounts. Commonly, offenders intercept legitimate invoices or emails from transaction partners that are known and change the banking details to include fraudulent payment information. 

Victims of BEC will unknowingly transfer funds to the offender, which would in turn go unnoticed until the intended recipient of the fund becomes aware and enquires about the payment yet to be received, or the victim becomes aware that the funds have been deposited incorrectly.

The toll on SMB

How BEC is affecting businesses in Australia

Dangerously Deceptive

BEC attacks are particularly difficult to prevent. This is due to the fact that perpetrators rely on social engineering techniques and impersonation to drive people into acting on the attackers behalf, as opposed to employing malware. Threat detection solutions used traditionally to combat BEC attacks that analyse metadata, links and email headers often miss these attack strategies. 

BEC attacks do not require advanced tools or tradecraft to execute. As such, they are present in any forms, with the level of sophistication driven by the attacker’s ability and motivation. Attackers will research their target and setup a spoof domain (or compromise a legitimate email) to send a falsified financial email to their target. This can be difficult to detect, with attackers constantly developing more advanced fraud techniques.

Scammed out of Millions

According to the Australian Federal Police (AFP),  BEC has resulted in a loss of $79 million to cybercriminals in the past 12 months. Further, BEC scams have occured over 3,300 times in the past twelve months. Despite efforts, police have only managed to retrieve $8.45 million, a fraction of the total loss. 

In one case, the AFP assisted an Australian business, which was compromised when offenders who claimed to be staff sent internal invoice emails to the company’s finance area, but with altered bank details. The business processed two payments within a few days – transferring $519,545 and then $2,148,938 to a Singaporean bank account.

The threat is on the rise in Australia

In the tight-lipped world of cybersecurity, it is an open secret that for many years, Australian organisations who fell victim to hackers have been quietly paying millions in ransoms for their data that was stolen or encrypted. 

This money has gone to criminal organisations, thus encouraging further attacks and creating an ongoing  cycle. 

Experts say that Australia along with the rest of the world are facing a “tsunami of cyber crime.”

In the past year, a 55 per cent increase in BEC attacks have been reported, according to the ACSC, government’s cyber security agency.

0
%
Increase in BEC attack reports in the past year
$
0
mil
Lost to BEC scams in 2020
0
%
of cybercrimes in Aus are BEC incidents
0
%
Rise in reported losses for 2021 (vs 2020)

WARNING SIGNS

What to look for

There are four standard methods attackers use to impersonate trusted contacts:

  • 1. Attackers alter the email ‘sender’ attribute to make emails appear to come from different people.
  • 2. Attackers impersonate the victim’s real first and last names to register a free email address (such as Gmail).
  • 3. Attackers register a fake domain that looks visually similar to the genuine domain i.e. @Mircosoft.com.
  • 4. The attackers utilise legitimate credentials gained through phishing attacks or data breaches.

Common types of BEC attacks include:

  • CEO impersonation

CEO’s and other senior staff members are common targets for impersonation. The attacker will masquerade as the authority figure and request payments or access to sensitive data.

  • Supplier impersonation

Large financial sums are trasferred routinely in business-to-business relationships. If an attacker can impersonate a supplier successfully, they will attempt to ‘update’ the banking details so that the target sends the next legitimate payment to the attacker’s bank account.



  • Employee impersonation

This is a common attack vector, as threat actors can carry it out from almost any corporate email account. Employee Impersonation sees the attacker attempt to replace a legitimate employee’s bank account details with their own – usually under the guise of ‘updating’ their details. The victim company then sends salary payments to the attacker’s bank account.

  • Customer impersonation

When impersonating a customer in a B2B relationship, an attacker will utilise counterfeit purchase orders and try to have goods delivered to the attacker for resale. 

  • Gift card fraud

While impersonating an authority figure, the attacker will request the victim purchase gift cards and email the serial numbers to the attacker, often promising remuneration through expenses. The attacker then sells the gift card serial numbers on the black market.

ACTION PLAN

Our advice and recommendations

BECs can be combatted with relative ease. If you are vigilant against phishing, use strong passwords and 2-factor authentication, implement protective business processes and and train your staff on what to look out for then you can mitigate the likelihood of falling victim to BEC attacks.

If you have been a victim of business email compromise, carry out the following steps: 

  • contact your bank as soon as possible if you’ve send money or bank details to a scammer

  • report the incident to the ACSC

  • if any of your email accounts were compromised, change your password for your email account(s), notify anyone affected, and protect your stakeholders with a warning notice on your website informing them of the scam.

The latest on BEC & phishing attacks

Gridware is proud to be a thought-leader in cybersecurity, creating and leading conversations in this space. Check out a selection of our published work from our Sydney based Cyber Defence Centre (CDC), and learn how our cyber expertise has led to partnerships with leading Australian Universities.

How Gridware can help

Training & Awareness

Your users are the last line of defence. Inform them about the latest email threats, and ensure that they understand their fraudulent nature and know how to report them to your security departments. Gridware security awareness training and phishing simulation provides all necessary tools to train your users to recognise and report phishing emails, which will prevent email fraud and data loss.

Security Assessments

As a provider of CREST-approved vulnerability assessment, social engineering and red teaming services, Gridware’s ethical hacking team has extensive experience of assessing organisations’ technology, personnel and processes against the latest attack techniques and helping organisations to address them.

Business Process Consultancy

Business can avoid falling victim to BEC scams with the right business processes in place. Gridware will assess your processes for any weakpoints and advise on how to mitigate the threats. We can also provide an action plan for dealing with potential threats.

Proactive Monitoring

Firewalls and antivirus software are not able to comprehensively defend against the latest types of memory-resident and polymorphic malware. 

Our certified security professionals employ cutting-edge threat intelligence to hunt for malware and other cyber threats and help quickly shut them down.

Get in touch today

Our team is ready to answer your queries. Contact us now.

Site Navigation

Contact

Sydney Offices
Level 12, Suite 6
189 Kent Street
Sydney NSW 2000
1300 211 235

Melbourne Offices
Level 13, 114 William Street
Melbourne, VIC 3000
1300 211 235

Perth Offices
Level 32, 152 St Georges Terrace
Perth WA 6000
1300 211 235

Incident Response

Penetration Testing

Governance & Audit

Company

About Gridware

Learn more about the team at the forefront of the Australian Cyber Security scene.

About Us →

Meet the Team →

Partnerships →

Careers

Learn more about the team at the forefront of the Australian Cyber Security scene.

Career Opportunities →

Internships →

Media

Media appearances and contributions by Gridware and our staff.

See More →

Services

Services

Whether you need us to take care of security for you, respond to incidents, or provide consulting advice, we help you stay protected.

View all services →

Web App Pen. Test Calculator →

Network Pen. Test Calculator →

Featured Categories

Governance & Audit

Legal and regulatory protection

Penetration Testing

Uncover system vulnerabilities

Remote Working & Phishing

Fortify your defenses

Cyber Security Strategy

Adaptation to evolving threats

Cloud & Infrastructure

Secure cloud computing solutions

View All Services

Products

Gridware 360

End-to-end security suite

Gridware Managed Services

Comprehensive & proactive security

Gridware CloudControl
360

Harness the benefits of cloud technology

Gridware Incident Response 24/7

Swift, expert-led incident resolution

Solutions

By Industry

By Regulation

By Threats

Resources

Resources

A collection of our published insights, whitepapers, customer success stories and more.

Subscribe to Cyber Insights

Published Insights

Cybersecurity Latest

Success Stories

Customer success stories from real Gridware customers. Find out how we have helped others stay on top of their Cyber Security.

Read More →

Contact Us