Business Email Compromise (BEC)
Business Email Compromise is widely spread and successful. It costs Australian businesses millions of dollars every year — and it can happen to anyone.
BEC works because of two things
The emails look legitimate, come from known addresses or convincing lookalikes, and create urgency around payment or account changes. Even careful, experienced business people get caught out.
The financial rewards are high and the risk of getting caught is low. This means organised crime groups invest significant resources into making BEC attacks more convincing and harder to detect.
Two ways BEC attacks occur
Someone pretending to be you
Someone pretending to be you may send your customers fake invoices from a similar email address. Your customer doesn’t realise the sender is different and they pay the bill into the wrong account. Your customer loses the money and you probably don’t get paid quickly as a result.
Someone has hacked your email system
Your email system may get compromised by you or another user giving away their email password to a fake website. Now the hacker has control of your email and sends fake invoices to your customer but from your email address. Your customer pays into the wrong bank account. You lose the money as you are the one who was compromised.
Don’t want to lose thousands of dollars?
Enable MFA on all accounts
Ensure MFA is set up on yours and all staff emails. This is the single most effective protection against account compromise.
Use a password manager
Don’t reuse the same password over and over. Use a password manager like LastPass to generate and store unique passwords for every account.
Educate your users
We have training courses and simulations we can send to your staff to help them recognise and avoid BEC attacks.
📥 Receiving invoices
Received an invoice recently from a supplier that has asked you to pay into a different bank account? Don’t pay it. Instead, call the supplier on their known trusted phone number and have a conversation. Don’t respond to the email.
📤 Sending invoices
Sending invoices to new clients? Give them a call. Tell them you are about to send them an invoice. Ask them to verify the bank account details with you over the phone before they pay.