Business Email Compromise: 5 Steps Protecting You From Email Hackers

Business Email Compromise is a new form of cybercrime. Working from home, which is currently widespread. The Check Point Research team, at Check Point Software Technologies Ltd. sees a current trend that cybercriminals are trying to deceive and exploit employees in the home office to carry out fraudulent transfers. Business Email Compromise (BEC) is the name of this criminal approach. The  FBI Internet Crime Report 2019  showed that BEC stole $ 1.7 billion in the United States alone.

Business Email Compromise: What’s Behind It?

The term BEC stands for Business Email Compromise and describes a particular scam that is popular with hackers. The attackers cleverly gain access to the mail accounts of decision-makers in a company or their suppliers. As soon as they have this, they start to read the email traffic, understand the processes and spy on the employees.

The aim of the whole thing is trickery: the hackers want to gain so much knowledge about the company’s internal structure and communication methods that they can pretend to be decision-makers – CEO or CFO – and the employees with fraudulent but cleverly faked To deceive news. If they succeed, they initiate supposedly authorized transfers to their accounts and digital wallets or redirect instructed transfers to them. Check Point has already shown how much money a group can steal single-handedly with this scam, based on a case unmasked by the research team.

Working In The Home Office As A Security Gap

With many employees working from home, the current situation makes it much easier to carry out this scam. Work instructions, agreements and customer contact – almost all communication currently takes place exclusively digitally. If an attacker then stole the access data to the account of a high-ranking employee, such as a CEO or CFO, there are only a few hurdles in the way of a successful attack. It is all the more important not to enable BEC in the first place and to train employees accordingly.

Christine Scheming, Regional Director Security Engineering CER, Office of the CTO at Check Point Software Technologies, explains, “We are in the midst of a paradigm shift in hacking activity: the criminals are taking advantage of the fact that many of us are currently working from home. We see the BEC scams as part of this trend. Any company or organization known for transferring large sums of money should be aware that this type of fraud is a primary target. Suppose employees work at home and rely primarily on email traffic. In that case, a skilled attacker can monitor and manipulate every single email – this is particularly worthwhile for employees who can move money. We also expect an increase in attempted fraud in 2020, as teleworking and digital communication have increased significantly in terms of the content value of the news. “

Five Steps To Protecting Against Business Email Compromise

1. Enable Multi-Factor Authentication For Work Email Accounts: This type of authentication requires several pieces of information to log in, such as a password and an SMS code. The implementation of multi-factor authentication makes it difficult for cybercriminals to gain access to employee emails.
2. Don’t Open Emails From Unknown Parties: When doing this, don’t click links or open attachments as they often contain malware accessing your computer system.
3. Double-Check The Sender’s Email Address: a spoofed email address often has a similar ending to the legitimate email address.
4. Always Verify The Address Before Sending Any Money Or Data: Make it standard practice for employees to confirm email requests for wire transfers or sensitive information from everyone in charge.
5. Use The “Forward” Function Instead Of “Reply” For Feedback On Business Emails: The correct email address must be entered manually or selected from the internal address book. The forwarding ensures that you are using the valid email address of the intended recipient.

ALSO READ: IT Security: These New Providers Are Entering The Market