The True Cost of Business Email Compromise

Scams are on the rise. Much of cybercrime is financially motivated, and attack tactics tend to follow what attackers perceive as being the most lucrative. Running a scam takes much less technical prowess compared to developing or deploying a malware campaign, making scams highly attractive to cybercriminals. A new report from the FBI’s Internet Crime Complaint Center reports that 76% of reported losses in 2019 were a result of scams, with 40% of loss because of business email compromise scams. For comparison, only 4% of loss was the result of ransomware or malware attacks. This advisory seeks to shed some light on the rapidly-evolving threat BEC poses to ZeroFOX customers.

Recommendations

Never click links or open attachments in suspicious email. If you receive an email suggesting that you direct payment to an account other than the one you generally deal with, confirm this with the organization - preferably not over email
Enabling ZeroFOX Advanced Email Security rules to protect from BEC scams and Phishing via your company’s e-mail

Details

Business email compromise, also known as BEC, is a type of email fraud that seeks to convince employees to transfer funds into an attacker-controlled account. BEC attackers often use social engineering tactics in order to achieve this. Commonly, BEC attackers will impersonate organizations with which a target already has a payment agreement. Attackers will communicate new payment account information to a target, usually under the pretense that the spoofed organization has changed their systems. Aside from requests for payment, attackers also request confirmation of information like phone numbers, to gain access to personally identifiable information, or PII.

Figure 1. Sample BEC email impersonating an employee’s CEO, requesting PII.

The FBI has recently released a new report on the actual cost of cybercrime to organizations across 2019. BEC made up over $1.7 billion of the total unadjusted $4.3 billion ($3.5 billion after adjustments for recovered funds) in reported losses. Of all cybercrime categories detailed in this report, scams - specifically BEC scams - are by far the largest percentage of this total.

Figure 2. Total loss across all cybercrime reported to the Internet Crime Complaint Center for 2019.

Although we often think of simple scams when we think of BEC, these attacks are often rather sophisticated and involve large-scale planning. In some extreme cases, like the kidnapping scam detailed in a previous advisory, blackmail and extortion techniques are used to create a sense of urgency within the victim, with the goal of getting the victim to do something they may not typically do under normal circumstances, like wire an attacker large sums of money. Other angles include the impersonation of individual employees in order to convince members of HR to update payroll information to an attacker-controlled account, as detailed in this report.

Also of note is that $78 million in losses could be traced back to social media as a vector for attack. Social media is often a pivotal part of social engineering-based attacks. Criminals often seek to establish fake or misleading social media accounts in order to better extort their victims out of cash. Sometimes this false persona development goes as far as a romantic relationship formed under false pretenses, as in this case detailed by the NY Times..

The combination of huge loss and continually evolving tactics poses a huge threat to organizations across all verticals, highlighting the importance of BEC protection. ZeroFOX highly recommends customers evaluate their BEC protection, and expand if necessary.