How to Guard Against Business Email Compromise
Running a business comes with numerous challenges, and one of the most critical is safeguarding your company against fraud. In a time when most business is conducted through email, fraudsters are taking advantage by impersonating or infiltrating the email accounts of employees, vendors, and others. Here’s what you need to know to protect your business from these kinds of scams – known as Business Email Compromise (BEC).
How to prevent Business Email Compromise (BEC)
Business Email Compromise is a growing threat to businesses of all sizes. These scams involve fraudsters impersonating a trusted entity, often through compromised email accounts, to deceive employees into transferring funds or sensitive information.
BEC can be very difficult to detect, because sophisticated criminals will mimic the communication style of the sender – who could be company executives or human resources personnel that most employees wouldn’t think to question. It may also take the form of bogus invoice schemes, where an employee email that is authorized to process invoice payments and fund transfers is infiltrated. BEC can even include those outside your organization, such as attorneys and vendors.
According to the FBI, total reported loss due to BEC in the last ten years now tops $50 billion. Protect your business from BEC with these best practices:
Employee Training: Educate your employees about the risks of BEC scams and the tactics used by fraudsters. Regularly conduct training sessions on identifying phishing emails, recognizing suspicious requests, and verifying the authenticity of email communication.
Implement Email Authentication and Protection: Utilize email authentication protocols such as DMARC (Domain-based Message Authentication, Reporting, and Conformance), DKIM (DomainKeys Identified Mail) and SPF (Sender Policy Framework) to help verify the authenticity of incoming emails. These measures can prevent email spoofing and domain impersonation. Work with IT professionals within your organization or a trusted partner to install these protocols, as well as ensuring that your email servers and systems are up-to-date and protected against known vulnerabilities. Regularly update security patches and use encryption to protect sensitive data.
Multi-Factor Authentication (MFA): Require employees to use multi-factor authentication to log into their email accounts. MFA adds an additional layer of security, making it more challenging for unauthorized individuals to access sensitive information.
Verify Payment Requests: Establish a clear protocol for verifying payment requests, especially those involving changes in payment details. Encourage employees to use trusted contact information to verify any such requests, particularly if you can speak with the individual in-person or in real time.
Monitor Email Traffic: Implement email monitoring tools to analyze the patterns of email traffic within your organization. Unusual spikes in email activity or multiple email addresses with slight variations could be signs of a phishing campaign.
Vendor Verification: When dealing with new or unfamiliar vendors, independently verify their identity and contact information. Contact them using trusted phone numbers or email addresses rather than relying solely on the information provided in unsolicited emails.
In today’s digital landscape, safeguarding your company from Business Email Compromise is essential for your financial well-being. By implementing the best practices outlined above, you can significantly reduce the risk of falling victim to these threats.
Have any questions about BEC or other possible threats to your business? Get in touch with your Treasury Management Representative.
