Business email compromise (BEC) attacks have caused more than $55 billion in losses between 2013 and 2023, according to an advisory from the U.S. Federal Bureau of Investigation (FBI).
“The BEC scam continues to target small local businesses to larger corporations, and personal transactions while evolving in their techniques to access those business or personal accounts,” the FBI says.
“Between December 2022 and December 2023, there was a 9% increase in identified global exposed losses. In 2023, the IC3 saw a growth in BEC reporting where funds were sent directly to a financial institution housing custodial accounts held by third-party payment processors, or peer-to-peer payment processors, and cryptocurrency exchanges which directly contributed to the increase in global exposed losses.”
The FBI notes that BEC is a global problem, affecting victims “in all 50 states and 186 countries, with over 140 countries receiving fraudulent transfers.” The Bureau outlines the following best practices to help organizations avoid falling for these attacks:
- Use secondary channels and/or two-factor authentication to verify requests for changes in account information
- Use unique passwords/passphrases. Make sure to use a unique password for every online service you use and try to change your passwords/passphrases periodically
- Ensure the URL in emails is associated with the business/individual it claims to be from
- Be alert to hyperlinks that may contain misspellings of the actual domain name
- Refrain from supplying login credentials or personal identifiable information (PII) of any sort via email. Be aware that many emails requesting your PII may appear to be legitimate
- Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's address appears to match who it is coming from
- Ensure the settings in employees' computers are enabled to allow full email extensions to be viewed
- Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
