What is BEC?

In a Business Email Compromise (BEC) attack, cybercriminals impersonate business professionals to trick victims into sharing information about their organisation. This attack is an advanced form of spear-phishing: a phishing attack that targets a specific individual or department within an organisation. In a BEC attack, cybercriminals impersonate a business partner, supplier, or prospect. The cybercriminals’ end goal is to transfer funds from an organisation to themselves. A successful BEC attack can result in a huge loss for the organisation involved.

Who Is the Target of a BEC Attack?

Originally, the primary targets for BEC attacks were employees in high-level and financial roles. As a result, many organisations began to take extra security measures to protect these employees. However, as technology and cybersecurity change, so do the cybercriminals’ tactics. Now, BEC attacks target employees of all types and levels. For example, cybercriminals have recently started to target employees in sales roles. Sales representatives are popular new targets because of their connection with financial departments for payment processing. Even employees with no ties to financial departments can be targeted. Any relationship a cybercriminal creates within an organisation can help them gain access to vital information. For example, administrative assistants often have access to high-level employees’ business calendars. If a cybercriminal targets an overly trusting assistant, the cybercriminal could win themselves a meeting with an executive.