A new study found that Business Email Compromise (BEC) rose to the most popular attack vector surpassing ransomware in 2022. The increase in email compromise has been attributed to a rise in successful phishing attacks, which went from 13% in 2021 to 33% in 2022. Phishing campaigns are becoming more sophisticated, combining publicly available information with breached data for highly tailored spear phishing attacks. Additionally, non-native speakers are using AI to compose more convincing-sounding messages that do not raise the red flags of previous years.
There are two types of BEC. First, the most common attack vector uses an email address similar to a coworker or business contact to trick an employee into approving an invoice or providing the criminal with information. In the second, more rare form of BEC, the criminal has access to the actual login credentials of the employee and uses their business email to steal money or information. In both cases, criminals have a highly informed understanding of the working relationship between business contacts in order to craft a believable spear phishing campaign.
A new version of this tactic is for criminals to order expensive construction materials, supplies, or hardware from a vendor impersonating a client they commonly do business with. Through the use of Net-30 or Net-60 payment terms many industries operate under, criminals can make off with the materials long before the company questions the transaction.
From a security standpoint, employees should be aware that BEC attacks are on the rise and should be encouraged to flag orders that appear out of the ordinary. Businesses should confirm orders through known client phone numbers and never phone numbers listed in the suspected email. Email filtering can help reduce BEC attacks that use outside domains. Lastly, users should be reminded not to click links in emails but type the known URL into a browser directly.
Quanexus IT Support Services for Dayton and Cincinnati
Request your free network assessment today. There is no hassle, or obligation.
If you would like more information, contact us here or call 937.885.7272.
Follow us on Facebook, Twitter and LinkedIn and stay up to date on by subscribing to our email list.
