Business Email Compromise (BEC) On the Rise

December 1, 2018 - In the past, email phishing attempts were easy to spot. There was usually a prince, or maybe even a long lost relative, in a faraway country requesting funds that would undoubtedly be returned to you with the promise of a too good to be true interest rate. Hitting delete was easy.
However, as technology has evolved, methods of deception have grown more sophisticated and perpetrators have organized into crime groups that target not only individuals, but corporations of all sizes. In 2013, the FBI identified and began tracking these cyber financial fraud attempts on businesses as Business Email Compromise (BEC). According to the FBI’s Internet Crime Complaint Center (IC3), “the BEC scam continues to grow, evolve, and target businesses of all sizes. Since January 2015, there has been a 1,300 percent increase in identified exposed losses, now totaling over $3 billion.”

How A BEC Scam Works

1. Identify a Target
• Organized crime groups target companies of all size and use information available online (for example, company websites) to identify executives or finance officers in organizations
2. Grooming
• After an executive or finance officer is identified, the perpetrators will begin sending phishing emails and/or telephone calls to individuals employed by the company or in some cases, email contacts, to request funds. Often the emails will indicate there is a past due invoice that must be paid immediately or other wording to create the illusion that money must be sent quickly.
3. Exchange of Information
• Once convinced that the request is a legitimate business transaction, the victim is provided wire transfer instructions.
4. Wire Transfer
• After the victim initiates the wire transfer, the funds are sent to a bank account controlled by the organized crime group.

Tools Used in a BEC Scam

Spoofing Email Accounts or Websites: Look out for slight variations on legitimate addresses
(for example JohnSmith@XYZcompany.com to JohnSmith@XYZ-company.com).
Spear-phishing: Bogus emails believed to be from a trusted sender will prompt victims to reveal confidential information to the BEC perpetrators that will later be used to extract more funds.

How to Protect Your Business

As sophisticated as these fraud attempts may be, there is an easy solution to thwart them: face-to-face or voice-to-voice communications. If you are ever in doubt about the legitimacy of a request from Flores, call our office at 800.532.3327 where we are happy to verify the details of any legitimate requests. Our phones are answered by a live person, Monday through Friday from 8:30 a.m. to 5:00 p.m. EST.

Resources:

Business Email Compromise: Cyber-Enabled Financial Fraud on the Rise Globally
Don’t take the bait: Here’s how taxpayers can avoid getting caught by a phishing scam
Security Summit Partners highlight new password guidance, urge taxpayers and practitioners to protect all accounts
IRS, Security Summit Partners warn public: It’s shopping season for identity thieves, too; Tax Security Awareness Week offers tips