You are the weakest link: How to stop the costliest internet scam
According to Steve Flynn, Sales and Marketing Director, ESET Southern Africa, it’s long past time organisations get a handle on business email compromise scams which generated more losses for victims in 2021 than any other type of cybercrime.
While ransomware, hacking, API hacks, and all the other cybersecurity threats make headlines, it’s worth remembering that the costliest internet scam is still business email compromises, according to the latest FBI Internet Crime Report.
Among the complaints received by the FBI in 2021, ransomware, business e-mail compromise (BEC) schemes, and the criminal use of cryptocurrency are among the top incidents reported. Technology-based systems are under attack, and they cost organisations around the world billions in lost funds.
The FBI’s Internet Crime Report for 2021 correlates with what we see in South Africa; business email compromises remain one of the most concerning threat vectors because the weakest link is not something that can be easily patched as it is a human being. The old adage of people being the weakest link in security is especially true when it comes to email threats. Here, cybercriminals can arguably generate their biggest ‘bang-for-buck’ by using social engineering tactics on their targets and persuading them to follow instructions.
Despite the great efforts that employee organisations and financial institutions go through to educate customers and staff on what to avoid, many still fall victim, unknowingly providing access to cybercriminals. Phishing is the most obvious example of these efforts.
The one specific type of cybercrime leveraging phishing messages is business email compromise and it has been the highest-grossing of any criminal activity over the past few years.
The latest FBI Internet Crime Report reveals that once again in 2021, these scams generated more losses for victims than any other type of cybercrime.
It’s time that organisations got a handle on email compromises and developed a layered defensive approach to mitigate the risk of losing large sums of money to faceless fraudsters.
The report reveals that while only 19 954 complaints of BEC were received last year – far behind the leading complaints of phishing (324,000), non-payment/non-delivery (82,000) and personal data breach (52,000) – the loss of US$2.4bn through BEC is of a far higher value than any of the more reported crimes in the list.
While this means that it might seem as much of a problem as the other types of fraud because the case number is lower, it’s the one type of fraud that costs businesses the most – an 82 percent increase over 2020 and almost a third of all cybercrime losses in 2021.
How does BEC work?
At a simple level, BEC is a type of social engineering. Members of finance teams are usually targeted by whom they believe to be a senior executive or CEO that wants an urgent money transfer to happen, or potentially a supplier that requires payment.
As implausible as it sounds, these scams occasionally still work, because the victim is usually pressured to act, without being given time to think through the consequences of their actions – classic social engineering. Sometimes fraudulent invoices with updated banking details are all that is required.”
It only needs to work occasionally to make it worth the while of a fraudster.
Because these attacks do not use malware, they’re harder for organisations to spot. AI-powered email security solutions are getting better at detecting suspicious behavioural patterns which can indicate when a sender may have been spoofed.
User awareness training and updated payment processes are therefore a critical part of layered BEC defence.
What the future holds
The bad news for network defenders is that the scammers are still innovating. The FBI warned that deepfake audio and video conferencing platforms are being used in concert to deceive organisations nowadays.
Deepfake audio has already been used to devastating effect in two standout cases. In one, a British CEO was tricked into believing his German boss requested a €220,000 money transfer. In another, a bank manager from the UAE was duped into transferring US$35 million at the request of a ‘customer.’
This kind of technology has been with us for a while. The concern is that it’s now cheap enough and realistic enough to trick even expert eyes and ears. The prospect of spoofed video conferencing sessions not only using deepfake audio but also video, is a worrying prospect for CISOs and risk managers.
What can I do to tackle BEC?
The FBI, security industry bodies and companies like ESET are doing their best to disrupt BEC gangs where they operate. But given the huge potential profits on offer, arrests will not deter cyber-criminals, which is why prevention is always the best strategy.
Organisations need to consider the following:
- Invest in advanced email security that leverages AI to discern suspicious email patterns and sender writing styles
- Update payment processes so that large EFT transfers must be signed off by two employees
- Doublecheck any payment requests again with the person allegedly making the request
- Build BEC into staff security awareness training such as in phishing simulations
- Keep updated on the latest trends in BEC and be sure to update training courses and defensive measures accordingly
Like any fraudsters, BEC actors will always go after low-hanging fruit. Organisations need to make themselves a harder target, which will hopefully lead to opportunistic scammers turning their attention elsewhere.
Invitation: ESET World 2022
You are cordially invited to the ESET World ’22 online press event on Tuesday May 31st, 2022.
The Russian invasion of Ukraine left us all in shock and disbelief. It has also put ESET on the frontlines of the cyberwar. Join us to hear ESET’s latest research findings on Ukraine, including our work with Ukraine CERT during the recent attempt to disrupt the country’s power grid. Our researchers will also uncover advanced threat actors targeting defence and aerospace companies and you can also look forward to hearing the keynotes from ESET’s CEO and CTO.
Gain exclusive access to the latest ESET research:
- Past and Present Cyberwar in Ukraine by Principal Threat Intelligence Researcher Robert Lipovsky
- Worldwide aerospace and defence contractors under attack by Lazarus by Director of Threat Research Jean-Ian Boutin
As well as these research exclusives, you will have the opportunity to learn about the latest malware trends from ESET Research’s latest Threat Report before its publication and Chris Hadfield will be discussing the intricacies of technology, science and life. For more information on the event, including talk abstracts, speaker bios and the agenda, please click here.
How to join
- Click on the link below and fill out a short registration form.
- Add ESET World to your calendar.
- You will receive an access link the day before the event. This link will provide you with access to the live stream and video archive.
Please note, all talks will appear in the video archive immediately after the event, meaning those unable to attend the live stream will still be afforded time to watch the latest news from ESET before the news embargo is lifted in the following days.
We look forward to welcoming you to ESET World!
About ESET
For more than 30 years, ESET® has been developing industry-leading IT security software and services to protect businesses, critical infrastructure and consumers worldwide from increasingly sophisticated digital threats. From endpoint and mobile security to endpoint detection and response, encryption and multifactor authentication, ESET’s high-performing, easy-to-use solutions unobtrusively protect and monitor 24/7, updating defences in real-time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company that enables the safe use of technology. This is backed by ESET’s R&D centres worldwide, working in support of our shared future. For more information, visit www.eset.com/za or follow us on LinkedIn, Facebook, and Instagram.