How to Protect Your Business from Email Compromise in a Changing Cybersecurity Landscape

Business email compromise (BEC) is a cyberattack that targets organisations to steal money or critical information. The attacker impersonates a trusted person, such as a CEO, a vendor, or a lawyer, and sends a fraudulent email to trick the recipient into transferring funds, paying a fake invoice, or disclosing sensitive data.

BEC is not a new threat but is becoming more prevalent and sophisticated in the current cybersecurity climate. According to the FBI, $50 billion has been lost in domestic and international BEC. A $7 billion increase from 2022.

The rise of BEC is driven by several factors, such as:

• The growing sophistication of social engineering techniques enables attackers to craft convincing and personalised emails that bypass spam filters and deceive recipients.
• There is a lack of awareness and education among users, who may not be familiar with the signs of BEC or the best practices to prevent it.

Therefore, businesses of all sizes and sectors must proactively protect themselves from BEC:

• Educate your users. User education is the first and most important line of defence against BEC. Ensure your employees know the common types and indicators of BEC, such as urgent or unusual requests, changes in payment details, or grammatical errors. Train them to verify the identity and authenticity of the sender before responding to any email, especially if it involves money or information. Use simulated phishing exercises to test and reinforce their skills and knowledge.
• Implement robust security policies and controls. User education alone is not enough to stop BEC. You also need to enforce security policies and controls that can reduce the risk and impact of BEC. For example, you can implement multi-factor authentication, encryption, and digital signatures for your email accounts and transactions. You can also use email security solutions that detect and block malicious emails, such as those that use spoofed domains, compromised accounts, or malware attachments.
• Monitor and report suspicious activities. User education and security controls can help you prevent most BEC attacks but cannot guarantee 100% protection. Therefore, you must monitor your email and financial activities for anomalies or red flags, such as unusual payment requests, delays, or discrepancies. If you suspect or encounter a BEC attempt, report it immediately to your IT department, bank, and the relevant authorities.

BEC is a damage and growing threat that can cause significant losses and damage to your business.

Remember, prevention is better than cure, and education is critical to prevention.