What is business email compromise and how to prevent it

You don’t have to work in the finance department of a big company to be the target of business email scams. Business Email Compromise (BEC) is the term for financial cyber events in which the targeted individual is contacted through their work email. The cybercriminal uses a hacked or fake account that looks legitimate in an effort to trick the target into sending funds.

How to protect yourself

Be proactive

• You are your company’s first line of defense. Know your company’s cybersecurity plan and how to respond to any suspicious emails.
• Require multiple users to initiate and approve transactions. If an email looks strange, look up the sender and email or call them (don’t use the number they provide).
• Never trust unknown individuals. Verify everything they claim and do not send sensitive information to anyone whose identity you can’t confirm.
• Invest in antivirus software and other cybersecurity software that can flag suspicious emails and websites.
• Don’t call any numbers, click on links provided or download attachments from senders until you verify their identity.
• Escalate if you are at all unsure. Take the time to discuss your suspicions with your manager or a colleague.

If you suspect you’ve been targeted

• Don’t delay. Acting quickly after an event can minimize damage to your business.
• Contact your bank’s servicing desk or support staff to report a fraudulent transaction as soon as you can.
• Know and follow your local laws and guidelines for cyber incidents.
• Document everything about the event. The more information you have, the better prepared you will be to assist an investigation, and the better prepared you will be against future cybercrime attempts.

Why it’s important

Cybercriminals do not discriminate, with targets ranging from wealthy individuals and families to employees at small businesses, nonprofits, school systems and churches.

A common threat method is called phishing, where seemingly legitimate messages are sent via email or messaging platforms to gain access to systems or data or to install malware (malicious software). This often involves the targeted individual entering sensitive data or clicking on malicious links.

There are different types of phishing:

• Vishing: a cybercriminal impersonates a trusted source or uses tactics such as robocalls, to scam people out of data and money over the phone.
• Smishing: utilizes SMS and messaging apps to scam people out of data and money.
• Spear phishing: a highly targeted phishing campaign designed for specific individuals.
• Spoofing: disguises communications in order to appear to be from someone else, including legitimate businesses or employees. Cybercriminals can spoof emails, phone numbers and websites.

Be alert, business email scams can appear to come from anyone, including:

• A supplier. A message arrives from a hacked email address to notify you of a bank account change or to request payment.
• An attorney. A message often arrives during a transaction such as a home purchase, with directions to send an expected payment, like a down payment.
• A familiar address. A message appears to come from someone you know and asks for confidential information, like payroll records.

The Global Information Security (GIS) team at Bank of America is made up of information security professionals staffing multiple security operations centers across the globe who work 24/7 to keep data and information safe.