What Is Business Email Compromise (BEC)?
Business Email Compromise (BEC) is a phishing email scam that typically targets employees of companies who regularly send wire transfers to their partners or third-party vendors.
Occasionally referred to as "man-in-the-email," Business Email Compromise uses spoofed or compromised email accounts to trick email recipients into providing company information, sending money, or sharing company innovations and technology.
BEC uses social engineering techniques to impersonate company executives, accounting departments of foreign partners, and other senior members of the company and win the trust of the email recipient.
Cyber criminals behind these scams know that most people don't scrutinize sender email addresses or notice slight URL discrepancies.
Along with familiar, urgent, and strategic email wording, these techniques make it difficult for company employees to recognize BEC threats.

Source: Trend Micro
How Common is BEC?
According to the Financial Services Sharing and Analysis Center (FS-ISAC), BEC crimes saw a 300% increase in 2022 from the prior year. The Federal Bureau of Investigation tells a similar story, slotting BEC as one of the costliest cyber crimes to date.
Between April 2022 and April 2023 alone, Microsoft Threat Intelligence detected 35 million BEC attempts, with an average of 156,000 daily attempts.
The above statistics reinforce how prevalent and dangerous BEC attacks are to companies and individuals tricked into giving up money, company information, and technology.
Watch the following video about preventing BEC with security awareness and phishing simulations to understand how easy it is for anyone to become a victim of a BEC scam.
Types of Business Email Compromise
There are five types of BEC scams that you need to be aware of:

Source: Fortinet
How Business Email Compromise Works
Because of the nature of the crime, a BEC attack requires a strategic and thorough approach.

Typically, employees believe they're acting in the organization's best interest by paying an overdue invoice or transferring funds to a new company partner.
It's important to remember that BEC schemes rely on savvy social engineering techniques and the human element of trust.
Phishing simulations allow you to identify which employees are prone to BEC scams and phishing attacks, demonstrating how easy it is for cyber security attacks like BEC to happen.
How To Prevent BEC Attacks
To prevent BEC attacks, do the following:
1.
Educate your employees about the five types of BEC attacks. Use free phishing simulation tools to educate and identify BEC and phishing risks.
2.
Use proven security awareness training and phishing simulation platforms to keep BEC and social engineering risks in mind. Create internal cyber security heroes committed to keeping your organization cyber secure.
3.
Remind your security leaders and cyber security heroes to regularly monitor employee BEC and phishing awareness with phishing simulation tools. Take advantage of BEC microlearning modules to educate, train, and change behavior.
4.
Provide ongoing communication and campaigns about cyber security, BEC, and social engineering. This includes establishing strong password policies and reminding employees about the risks that can come in the form of emails, URLs, and attachments.
5.
Establish network access rules that limit the use of personal devices and the sharing of information outside of your corporate network.
6.
Ensure that all applications, operating systems, network tools, and internal software are up-to-date and secure. Install malware protection and anti-spam software.
7.
Incorporate cyber security awareness campaigns, training, support, education, and project management into your corporate culture.
Phishing simulation is the best way to raise awareness of BEC risks and identify which employees are at risk for BEC scams and phishing.
BEC relies on phishing techniques to access the company email system and uses social engineering techniques to convince employees to act as requested.
Phishing simulation lets you easily incorporate cyber security awareness training into your organization in an interactive and informative format.
People see first-hand how personalized trustworthy emails are used to steal personal and corporate information. Real-time BEC and phishing simulations are ideal for any organization to educate people and increase alertness levels to BEC schemes and techniques.
How Can Phishing Simulations Help Prevent BEC?
Phishing simulations allow you to show employees in real time how easy it is to fall victim to a BEC attack.
Using real-world examples and sophisticated phishing simulations, phishing simulations help employees realize why verifying email addresses and confirming requests for funds or confidential information is essential before acting.
Phishing simulations give your organization these top 10 benefits in the defense against BEC scams and other cyber security threats:
1. Measure the degrees of corporate and employee vulnerability
2. Eliminate the cyber threat risk level
3. Increase user alertness to BEC and phishing risk
4. Instill a cyber security culture and create cyber security heroes
5. Change behavior to eliminate the automatic trust response
6. Deploy targeted anti-phishing solutions
7. Protect valuable corporate and personal data
8. Meet industry compliance obligations
9. Assess the impacts of cyber security awareness training
10. Segment BEC and phishing simulation
To learn more about BEC and how you can keep your organization cyber secure, take advantage of our free cyber security awareness resources:
Contact us at 1-866-889-5806 or at [email protected] to learn more about BEC.
Terranova Security is committed to delivering people-centric training that makes your organization cyber security aware.