2019 Threat Outlook – Business Email Compromise Continues to Threaten Banks and Credit Unions

Today, cybersecurity threats are ubiquitous. Cyber attackers are infiltrating email systems, computer networks and anywhere else they can find weaknesses to exploit. They’re using a variety of schemes to steal data, money and other assets—and tarnish corporate reputations.

Financial institutions are prime targets for cyber criminals, which is why cybersecurity must be a top priority. In 2018 alone, more than 500 security incidents affected financial and insurance organizations—with almost 25 percent having confirmed data disclosure, according to the Verizon Data Breach Investigations Report.

In addition, the costs to remedy the damage from cybercrime is higher than ever, and still growing. Now, the average cost of cybercrime for an organization is $13.0 million, up from $1.4 million in 2017, according to Accenture’s 2019 Cost of Cybercrime Study.

The Rise of Business Email Compromise

Not only are cyber threats rampant, but they’re becoming more devious and complex. For example, business email compromise (BEC) is one of the top threat vectors for 2019. BEC is a sophisticated type of phishing scam that’s perpetrated through five main scenarios, according to the FBI’s Internet Crime Complaint Center (IC3). Often, BEC scammers pretend to be a foreign supplier and attempt to trick employees into wiring funds for outstanding invoices into their bank account. In another common BEC scam, attackers impersonate a high-level executive, such as a CIO, CEO, or CFO, to try to deceive employees into wiring money.

However, BEC doesn’t always entail requesting wire transfers. More recently, BEC has involved data theft—the receipt of fraudulent emails asking for either wage or tax statement forms or a company list of personally identifiable information (PII). Regardless of the scenario, the business executive’s email is compromised, either by hacking (normally through a personal email account) or spoofing (altering the sender’s information to mimic a legitimate email request).

Like other cybercrimes, BEC continues to evolve and is rapidly expanding. The scam has been reported by victims in all 50 states and in 100 countries, according to IC3. Many BEC complaints have involved businesses and associated personnel using open source email accounts; the phrases “code to admin expenses” or “urgent wire transfer;” requested dollar amounts that are similar to normal business transaction amounts; and IP addresses that frequently trace back to free domain registrars.

Strengthen Cybersecurity Processes

Financial institutions and other organizations can protect themselves from BEC by implementing robust internal prevention techniques at all levels, particularly with front-line employees who are more likely to receive initial phishing emails. Some institutions are reducing BEC-related fraud by simply holding customer requests for international wire transfers for an additional time period to verify the legitimacy of the request. Other IC3-recommended strategies for strengthening bank cybersecurity against BEC include:

• Avoid free web-based e-mail accounts;
• Be careful about what is posted to social media and company websites (especially job duties/descriptions, hierarchal information, and out of office details);
• Be suspicious of requests for secrecy or pressure to take action quickly;
• Consider using additional IT and bank cybersecurity procedures, including a two-step verification process;
• Beware of sudden changes in business practices, such as being asked to contact a business associate through a personal email instead of company email address; and
• Provide security awareness training to all employees.

Regardless of the threat outlook for BEC and other cyber-attacks, financial institutions must have effective tactics for safeguarding their customer information, infrastructure and operations. This necessitates meeting regulatory and industry compliance standards for collecting, protecting and using private financial data.

To gain more insight into this area, as well as other key topics for CEOs to be aware of, download our white paper, Top IT Areas Where CEOs of Financial Institutions Should Focus: Important Questions and Answers.