Glossary: Cybersecurity Terms & Definitions

What Is Business Email Compromise (BEC)?

Scammers use email phishing to trick employees into financial or data fraud.

Business email compromise is a cybercrime where scammers use spear phishing via email to deceive employees into financial or data-related fraud.

What Is Business Email Compromise (BEC)?

BEC is an ever evolving and pervasive cyber threat that poses significant challenges to cybersecurity professionals. BEC is a sophisticated form of cybercrime that occurs when malicious actors employ social engineering techniques, particularly spear-phishing via email, to deceive employees into taking actions that compromise an organization's security. These actions often involve unauthorized fund transfers, disclosing sensitive information, or initiating malicious activities within the organization's network. BEC attacks are highly adaptable, and attackers continuously refine their tactics. Some common techniques include spoofed emails, domain spoofing, and fake invoices.

Why Is Business Email Compromise Important?

BEC attacks can have potentially devastating consequences for enterprises.

  • Financial loss: BEC attacks are typically aimed at tricking employees into making fraudulent financial transactions, such as wire transfers or payments to attacker-controlled accounts. When successful, these attacks can result in significant financial losses for businesses. In some cases, organizations have lost millions of dollars in a single BEC incident.
  • Data breach: BEC attacks often involve the compromise of sensitive business data, including financial records, customer information, and intellectual property. Unauthorized access to such information can lead to regulatory penalties, legal consequences, and reputational damage.
  • Trust and reputation: Falling victim to BEC attacks can erode trust in an organization's ability to safeguard sensitive information and conduct secure transactions. Customers, partners, and investors may lose confidence in a business that cannot protect its financial assets and data.
  • Legal and regulatory consequences: Many industries have specific regulations and legal requirements regarding data protection and cybersecurity. Falling victim to BEC attacks may result in non-compliance with these regulations, leading to fines and legal action.
  • Operational disruption: BEC attacks can disrupt normal business operations. Recovering from an attack can be time-consuming and expensive, impacting an organization's ability to serve its customers, meet deadlines, and maintain productivity.
  • Supply chain risks: BEC attacks can also target an organization's supply chain, compromising not only the organization itself but also its partners and vendors. This can lead to a cascading effect of damage throughout the business ecosystem.
  • Reputation and customer trust: If a company falls victim to a BEC attack, it can damage its reputation and customer trust. Customers may hesitate to do business with an organization that can't protect sensitive data or financial transactions.

In summary, BEC is important because it poses significant financial, operational, and reputational risks to organizations. Preventing and mitigating BEC attacks requires a multi-faceted approach that includes technology, employee training, and a strong cybersecurity strategy.

How Does Business Email Compromise Work?

BEC is a type of cyberattack that involves manipulating or impersonating trusted email accounts to deceive individuals within an organization. The primary goal of BEC attacks is to fraudulently obtain money, sensitive information, or access to systems. BEC attacks can take various forms, but they typically involve a few common steps.

  1. Target selection: Attackers conduct reconnaissance to identify potential targets within the organization. This may involve researching key personnel, their roles, and the relationships between employees.
  2. Email spoofing: Attackers may spoof the email address of a trusted individual or entity within the organization. They may use a similar-looking domain or email address to make it appear legitimate.
  3. Phishing email: The attacker sends a convincing phishing email from the spoofed email address. The email may address the recipient by name, be well-written, and may mimic the style and tone of previous legitimate correspondence.
  4. Social engineering: The email often conveys a sense of urgency. It may request a financial transaction, sensitive data, or other actions, such as changing a password or downloading a file.
  5. Manipulating the victim: The attacker relies on psychological manipulation to convince the victim to take the desired action. This may involve leveraging fear, trust, or authority to make the recipient more likely to comply.
  6. Action by the victim: If victims fall for the scam, they will take the requested action, which can include transferring funds, revealing sensitive information, or clicking on malicious links or attachments.