In yet another case of business email compromise, a charity is fooled through a combination of diligence, sophistication, and social engineering.
Back in August of 2019, Red Kit Community Housing, a U.K.-based charity, was victim of a BEC scam. According to a recently released notification about the scam, the cybercriminals did their diligence to identify external individuals at an entity that was providing services to the charity and, therefore, had their trust, spoofed a domain to represent the external entity, and used social engineering skills to make it seem like their communication was “a genuine follow up to an existing conversation.”
Whenever conversations over email involve money and the changing of banking details, there always needs to be a protocol to validate the request. To Red Kite’s credit, they do employ “a two-stage process to verify changes to payments and accounts which ordinarily would have caught this attempt.” But, in the case of this scam, the controls weren’t exercised in the way they should have.
According to Red Kite’s press release, “one key lesson is that no matter how good you believe your systems to be, the human dimension will always be a potential weakness.” This is why it’s imperative for organizations to realize just how much risk the user poses to the organization, and seek to eliminate that risk through continual Security Awareness Training. Through continual education, users can be taught be remain vigilant, especially in the face of any communications involving money and altering methods of payment.
The folks are Red Kite hope that through their sharing of this story, “…that colleagues in the sector reflect on their own systems and take the opportunity to ensure that this doesn’t happen to them.” Heed Red Kite’s warning.
Here's how it's done:
