We have gathered these resources and information to help you protect your business. A good way to stay "in the know" is with the KnowBe4 Security Awareness Training.
Business Email Compromise (BEC)
More than 400 businesses are the target of BEC scams every day.
A BEC scam is a form of phishing or spear phishing where an attacker impersonates a company executive (often the CEO) or other associate, and attempts to get an employee, customer, or vendor to transfer funds or provide sensitive information. Their end game is to steal information and ultimately your money.
Identified global BEC attacks increased by 100% between May 2018 and July 2019. The FBI reports these scams accounted for more than $26.2 billion in losses globally between June 2016 and July 2019. Watch the Old National video about Business Email Compromise:
The volume of spam emails continues to increase, and 76 percent of organizations reported being the victim of a phishing attack.
CEO/executive phishing can occur in different ways when scammers:
Send email to a business executive under a fake name, with the intent of tricking the executive to take some action
Gain access to an executive's mailbox and pretend to be the executive OR
Send emails to company employees from an executives domain name very similar to the target’s domain name (typically off by one or two characters).
Thieves usually take the time to learn about the organization’s management structure, and their end game is to trick controllers and other financial executives into conducting transactions, processing financial transfers, or other actions without going through proper authentication processes.
For example, a controller receives an email from someone they think is the CEO. The email requests money be transferred for what appears to be valid business reasons. The controller follows the directions in the email without confirming it is legitimate, thinking the CEO has initiated the request—when in reality they are sending money to cyber thieves.
Email is still the #1 delivery vehicle for malware, including ransomware.
Ransomware is a kind of malware in which the data on a victim's computer is locked, typically by encryption. Monetary gain is almost always the motive for ransomware attacks, and a ransom payment is demanded from the victim, in order to have their data decrypted and access returned. Often the ransom payment is required to be paid in virtual currency (i.e. bitcoin), so the cybercriminal's identity remains anonymous.
Ransomware attacks are different than other types of attacks, because the victim is usually notified about what has happened and given instructions on how to recover. Every employee of a company must stay vigilant to protect the organization from being a victim of ransomware.
