Inside the Business Email Compromise Problem

July 28, 2021

Business email compromise (BEC) is the most significant cybersecurity threat to enterprise organizations, with $1.8 billion in reported losses in 2020 alone. This type of email attack occurs when a cybercriminal uses social engineering to impersonate a trusted contact—typically an executive, coworker, vendor, or partner—in an effort to steal money or valuable information.

Because these emails rarely contain malicious links or attachments, they are difficult to detect by standard email security protocols, leaving organizations wide open to attack. New research from the FBI IC3 Internet Crime Report shows that BEC attacks account for 44% of all losses due to cybercrime, making it the most dangerous threat for the sixth consecutive year.

The Rising Cost of Business Email Compromise

Secure email gateways and other traditional security measures are unable to protect against these novel, never-before-seen attacks. Once they arrive in inboxes, your employees open and respond to them, putting your organization at risk for financial and reputational damage. Without a new approach, BEC will only continue to grow, and organizations worldwide will continue to suffer the consequences.

The IC3 Internet Crime Report shows that there were 19,369 victims of business email compromise attacks in 2020, costing organizations an average of $96,000 per attack. Making matters worse is the fact that this number only includes successful attacks where victims are conned into sending money—it shows nothing about the number of attempts and near-misses.

Employees Respond to BEC at Alarming Rates

Unfortunately, the impact of business email compromise attacks is much higher than what the FBI report shows. Our new research shows that an average organization receives more than 50 BEC attacks per month. Making matters worse, we found that 20% of employees engage with their attacker by responding to at least one email.

Bec data q2 2021

Even if employees are trained on how to detect an attack and respond appropriately, cybercriminals are constantly revising their schemes, attempting to stay ahead of changes in technology and training, and oftentimes doing so successfully.

Putting a Stop to Business Email Compromise

Business email compromise attacks are so successful because they do not contain traditional indicators of compromise—there are no suspicious links or malicious attachments to examine, and they often come from legitimate domains like Gmail or Yahoo. In other cases, they come from newly registered domains that have no negative reputations and may use lookalike tactics to fool people into thinking they are the real domain.

As a result, there is little that secure email gateways can do to block these attacks. In order to do so, you need a new type of email security—one that understands the good human behavior to identify and block the bad. Here at Abnormal Security, we use a unique behavior data science approach to profile and baseline good behavior. With a combination of identity modeling, behavioral and relationship graphics, and deep content analysis, we can stop emails that include suspicious information or requests—even without traditional indicators of compromise.

To learn more about the increasing BEC threat, including which types are most prevalent, download the CISO Guide to Business Email Compromise.

Previous
Blog podcast yellow cover
In engineering teams, there’s a mythical concept of a “10x engineer”— engineers who have 10x more impact and responsibility than the average engineer. Do these engineers actually exist? Is this a myth, or a possibility that engineers can realistically aim to become?
Read More
Next
Blog podcast green cover
Over the last three years building our ML-based cybersecurity products at Abnormal Security, I’ve benefitted enormously from discussions with colleagues in the ML space. This podcast aims to make some of those conversations available. In our second episode of Abnormal Engineering Stories...
Read More

Related Posts

B 10 15 21
With Detection 360, submission to threat containment just got 94% faster, making it incredibly easy for customers to submit false positives or missed attacks, and get real-time updates from Abnormal on investigation, conclusion, and remediation.
Read More
Extortion blog cover
Unfortunately, physically threatening extortion attempts sent via email continue to impact companies and public institutions when received—disrupting business, intimidating employees, and occasioning costly responses from public safety.
Read More
Blog engineering cybersecurity careers
Cybersecurity Careers Awareness Week is a great opportunity to explore key careers in information security, particularly as there are an estimated 3.1 million unfilled cybersecurity jobs. This disparity means that cybercriminals are taking advantage of the situation, sending more targeted attacks and seeing greater success each year.
Read More
Blog hiring cybersecurity leaders
As with every equation, there are always two sides and while it can be easy to blame users when they fall victim to scams and attacks, we also need to examine how we build and staff security teams.
Read More
Cover automated ato
With an increase in threat actor attention toward compromising accounts, Abnormal is focused on protecting our customers from this potentially high-profile threat. We are pleased to announce that our new Automated Account Takeover (ATO) Remediation functionality is available.
Read More
Email spoofing cover
Email spoofing is a common form of phishing attack designed to make the recipient believe that the message originates from a trusted source. A spoofed email is more than just a nuisance—it’s a malicious communication that poses a significant security threat.
Read More
Cover cybersecurity month kickoff
It’s time to turn the page on the calendar, and we are finally in October—the one month of the year when the spooky becomes reality. October is a unique juncture in the year as most companies are making the mad dash to year-end...
Read More
Ices announcement cover
Abnormal ICES offers all-in-one email security, delivering a precise approach to combat the full spectrum of email-borne threats. Powered by behavioral AI technology and deeply integrated with Microsoft 365...
Read More
Account takeover cover
Account takeovers are one of the biggest threats facing organizations of all sizes. They happen when cybercriminals gain legitimate login credentials and then use those credentials to send more attacks, acting like the person...
Read More
Blog podcast green cover
Many companies aspire to be customer-centric, but few find a way to operationalize customer-centricity into their team’s culture. As a 3x SaaS startup founder, most recently at Orum, and a veteran of Facebook and Palantir, Ayush Sood...
Read More
Blog attack atlassian cover
Credential phishing links are most commonly sent by email, and they typically lead to a website that is designed to look like common applications—most notably Microsoft Office 365, Google, Amazon, or other well-known...
Read More
Blog podcast purple cover
Working at hyper-growth startups usually means that unreasonable expectations will be thrust on individuals and teams. Demanding timelines, goals, and expectations can lead to high pressure, stress, accountability, and ultimately, extraordinary growth and achievements.
Read More