New research from the Japan Computer Emergency Response Team provides needed insight into what tactics and methods are used as part of Business Email Compromise scams.
You hear about BEC scams every week. The FBI says BEC has cost business more than $2 billion. But what really happens inside a BEC scam? New data from JCERT sheds some light on exactly how attacks transpire.
Their data reflects attacks occurring between July and November 2019, and includes attack instances hitting over 40 countries throughout the world. Some of the more interesting details emerging from Japan’s analysis include:
- English is the overwhelmingly-used language in 89% of BEC scams regardless of target country
- Fake invoices from business partners was the most commonly-used scam
- Impersonation of the CEO or CFO was the second most common scam
- 90% of BEC scams used PDF files as the malicious attachment (according to the report, most use free PRF conversion tools to create these PDFs)
- The most common timing of a BEC scam occurs during the process of issuing an invoice (which aligns with the 75% of scams involving forged invoices)
JCERT provides some preventative measure recommendations to help stop these kinds of attacks from ever becoming successful:
- Anti-malware – they recommend having solutions in place to prevent malware infections, as well as an ability to detect external communication by malware during infection.
- Enhanced Authentication – to avoid unauthorized access, they recommend using multi-factor authentication, as well as the prohibiting of reusing passwords.
- Established Process and Review – organizations need to be able to detect when changes are made (specifically payment details) to be able to flag potential scams. Training of staff on correct procedures is also needed.
- Security Awareness Training – Spotting a scam a mile away is the best medicine for these attacks; according to the report “users should be trained and educated on how to identify phishing and prevent credentials from getting stolen.”
New-school Security Awareness Training is critical to enabling you and your IT staff to connect with users and help them make the right security decisions all of the time. This isn't a one and done deal, continuous training and simulated phishing are both needed to mobilize users as your last line of defense. Request your one-on-one demo of KnowBe4's security awareness training and simulated phishing platform and see how easy it can be!
