Sometimes known as ‘man-in-the-email’ scams or ‘CEO fraud’, BEC tricks employees into providing confidential information or sending money to someone they believe they can trust. Cybercriminals will either hack into the email accounts of C-suite / business or create new ‘fake’ versions of the email that appear to be authentic.

The cybercriminal imposters will often pose as a manager or member of the c-suite to email potential victims in the accounts or finance team with an ‘urgent’ request to send money via wire transfer as an example. This type of threat targets predictable human behaviours and rely on workers being busy, distracted or inattentive. The big challenge businesses face is the fact that most BEC attacks will not be detected by antiviruses, spam filters or other basic cybersecurity measures as they employ social engineering techniques, rather than malicious links or attachments.

Many large businesses and organisations have been compromised in this way with many others determined to keep threat behind closed doors.

• Bank of Ireland suffered an attack in May 2020 which resulted in the theft of €1.4m from one of its Dublin based subsidiaries.
• TSB bank suffered numerous cyberattacks during an upgrade in 2018 which resulted in a tsunami of BEC attacks on their customers
• Trinity College reported that it had lost 1m to a BEC scam after fraudsters had intercepted emails between the university and vendors. (Many Universities and colleges have been targeted throughout the UK and Ireland resulting in the loss of millions.
  
  

It’s not exclusively the finance or education sectors – every business or organisation is vulnerable to BEC attacks however the small to medium sized businesses are most susceptible often due to their limited resources and occasionally, a lack of IT personnel.