How to stop the costliest internet scam

Issue 3 2022 Information Security

According to Steve Flynn, sales and marketing director, ESET Southern Africa, it is long past time that organisations get a handle on business email compromise scams which generated more losses for victims in 2021 than any other type of cybercrime.


Steve Flynn.

While ransomware, hacking, API hacks, and all the other cybersecurity threats make headlines, it is worth remembering that the costliest internet scam is still business email compromises, according to the latest FBI Internet Crime Report.

Among the complaints received by the FBI in 2021, ransomware, business e-mail compromise (BEC) schemes, and the criminal use of cryptocurrency are among the top incidents reported. Technology-based systems are under attack, and they cost organisations around the world billions in lost funds.

The FBI’s Internet Crime Report for 2021 correlates with what we see in South Africa; business email compromises remain one of the most concerning threat vectors because the weakest link is not something that can be easily patched as it is a human being. The old adage of people being the weakest link in security is especially true when it comes to email threats. Here, cybercriminals can arguably generate their biggest ‘bang-for-buck’ by using social engineering tactics on their targets and persuading them to follow instructions.

Despite the great efforts that employee organisations and financial institutions go through to educate customers and staff on what to avoid, many still fall victim, unknowingly providing access to cybercriminals. Phishing is the most obvious example of these efforts.

It’s time organisations got a handle on email compromises and developed a layered defensive approach to mitigate the risk of losing large sums of money to faceless fraudsters.

The report reveals that while only 19 954 complaints of BEC were received last year – far behind the leading complaints of phishing (324 000), non-payment/non-delivery (82 000) and personal data breach (52 000) – the loss of US$2.4 billion through BEC is of a far higher value than any of the more reported crimes in the list.

While this means that it might seem as much of a problem as the other types of fraud because the case number is lower, it is the one type of fraud that costs businesses the most – an 82% increase over 2020 and almost a third of all cybercrime losses in 2021.

How does BEC work?

At a simple level, BEC is a type of social engineering. Members of finance teams are usually targeted by someone who they believe to be a senior executive or a CEO that wants an urgent money transfer to happen, or potentially a supplier that requires payment.

As implausible as it sounds, these scams occasionally still work, because the victim is usually pressured to act, without being given time to think through the consequences of their actions – classic social engineering. Sometimes fraudulent invoices with updated banking details are all that is required.

It only needs to work occasionally to make it worth the while of a fraudster.

Because these attacks do not use malware, they are harder for organisations to spot. AI-powered email security solutions are getting better at detecting suspicious behavioural patterns which can indicate when a sender may have been spoofed, but they are not perfect. User awareness training and updated payment processes are therefore a critical part of layered BEC defence.

What the future holds

The bad news for network defenders is that the scammers are still innovating. The FBI warned that deepfake audio and video conferencing platforms are being used in concert to deceive organisations nowadays.

Deepfake audio has already been used to devastating effect in two standout cases. In one, a British CEO was tricked into believing his German boss requested a €220 000 money transfer. In another, a bank manager from the UAE was duped into transferring US$35 million at the request of a ‘customer’.

This kind of technology has been with us for a while. The concern is that it is now cheap enough and realistic enough to trick even expert eyes and ears. The prospect of spoofed video conferencing sessions not only using deepfake audio, but also video, is a worrying prospect for CISOs and risk managers.

What can I do to tackle BEC?

The FBI, security industry bodies and companies like ESET are doing their best to disrupt BEC gangs where they operate. But given the huge potential profits on offer, arrests will not deter cybercriminals, which is why prevention is always the best strategy.

Organisations need to consider the following:

Invest in advanced email security that leverages AI to discern suspicious email patterns and sender writing styles.

Update payment processes so that large EFT transfers must be signed off by two employees.

Doublecheck any payment requests again with the person allegedly making the request.

Build BEC into staff security awareness training such as in phishing simulations.

Keep updated on the latest trends in BEC and be sure to update training courses and defensive measures accordingly.

Like any fraudsters, BEC actors will always go after low-hanging fruit. Organisations need to make themselves a harder target, which will hopefully lead to opportunistic scammers turning their attention elsewhere.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
What does Agentic AI mean for cybersecurity?
Information Security AI & Data Analytics
AI agents will change how we work by scheduling meetings on our behalf and even managing supply chain items. However, without adequate protection, they become soft targets for criminals.

Read more...
Phishing attacks through SVG image files
Kaspersky News & Events Information Security
Kaspersky has detected a new trend: attackers are distributing phishing emails to individual and corporate users with attachments in SVG (Scalable Vector Graphics) files, a format commonly used for storing images.

Read more...
Crypto in SA: between progress and precaution
Information Security
“As cryptocurrency gains momentum and legitimacy, it’s becoming increasingly important for people to pay attention to financial security”, says Richard Frost, head of technology and innovation at Armata Cyber Security.

Read more...
Cyber recovery requires a different approach to disaster recovery
Information Security
Disaster recovery is about getting operations back on track after unexpected disruptions; cyber recovery, however, is about calculated actions by bad actors aiming to disrupt your business, steal sensitive data, or hold your system hostage.

Read more...
MDR users claim 97,5% less
Sophos Information Security
The average cyber insurance claim following a significant cyberattack is just $75 000 for MDR users, compared with $3 million for endpoint-only users, according to a new independent study.

Read more...
The impact of GenAI on cybersecurity
Sophos News & Events Information Security
Sophos survey finds that 89% of IT leaders worry GenAI flaws could negatively impact their organisation’s cybersecurity strategies, with 87% of respondents stating they were concerned about a resulting lack of cybersecurity accountability.

Read more...
Efficient, future-proof estate security and management
Technews Publishing ElementC Solutions Duxbury Networking Fang Fences & Guards Secutel Technologies OneSpace Technologies DeepAlert SMART Security Solutions Editor's Choice Information Security Security Services & Risk Management Residential Estate (Industry) AI & Data Analytics IoT & Automation
In February this year, SMART Security Solutions travelled to Cape Town to experience the unbelievable experience of a city where potholes are fixed, and traffic lights work; and to host the Cape Town SMART Estate Security Conference 2025.

Read more...
Kaspersky KATA 7.0 for targeted attack protection
Information Security Products & Solutions
] Kaspersky has announced a major update to its Kaspersky Anti Targeted Attack (KATA) including enhanced network detection and response (NDR) capabilities with deeper network visibility, internal threats detection and other critical security features.

Read more...
The role of advanced technologies in ransomware recovery
Information Security
As businesses increasingly adopt cloud technologies, the complexities of maintaining resilience and ensuring rapid recovery from such incidents become even more pronounced. The integration of advanced technologies is essential to navigate these challenges effectively.

Read more...