Business email compromise a key threat in 2019

Malicious groups and individuals continue to be highly active online in 2019 – highlighting the importance of robust education, processes and technology to organisations in tackling cyber-crime. Fraudulent ‘phishing’ messages that aim to trick people into disclosing sensitive information pose an ongoing and increasingly sophisticated threat. These scam messages – typically delivered over email – use a variety of techniques to convince the recipient they are legitimate communications, including the use of authentic logos, text and designs from trusted organisations.

Phishing messages may also include links to fake versions of legitimate websites. These fake websites aim to trick a visitor into entering details such as usernames or passwords. Messages may also include attachments loaded with malicious software that aims to infect a computer to disrupt its operations or capture sensitive information.

While variations such as ‘spear-phishing’ – that occurs when malicious groups target an individual by using his or her personal information to elicit sensitive information – are well known, business email compromise is a comparatively new but increasingly potent threat. Business email compromise occurs when a group or individual impersonates a business representative – often a senior executive – at an organisation to trick employees, vendors or customers to transfer money or sensitive information to the malicious party. The FBI noted in mid-2018 the incidence of ‘identified global exposed losses’ from business email compromise had risen 136% between December 2016 and May 2018 – with the real estate sector a prime target.

The Australian Cyber Security Centre (ACSC) noted in October 2018 “criminals are constantly developing increasingly sophisticated business email compromise techniques often include a combination of social engineering, email phishing, email spoofing [forging an email sender’s address] and malware [malicious software]” to trick recipients. Importantly for many organisations, the ACSC notes that business email compromise attacks tend to spike around tax time – when many people are busy and under pressure to complete workplace tasks quickly.

So how can your organisation protect itself against business email compromise? The ACSC has posted comprehensive information here about the types of business email compromise; how to recover from an incident; and techniques for minimising the risk of being caught out by this type of attack.

By Roger Carvosso, Product and Innovation Director