It has been brought to our attention that a small number of our clients have recently fallen victim to the Business Email Compromise (BEC) Scam and we would like to bring it to all of our clients attention to help you with your cyber security.
What is Business Email Compromise (BEC) Scam?
The Business Email Compromise (BEC) Scam is a scam performed by cybercriminals who fraudulently access devices such as mobiles, computers and tablets to illegally obtain money or goods. It involves a range of communication types such as emails, instant messages, SMS and social media tactics.
Although the scam surfaced in around 2013, Head of the Australian Cyber Security Centre, Ms Abigail Bradshaw CSC, said there has been a significant increase in the use of BEC scams by cybercriminals over recent year.
“This type of fraud has been used to hoodwink many Australians and Australian businesses, out of often very large sums of money,” said Ms Bradshaw. “In 2019-20 financial year, there were 4,255 reports of BEC scams reported through the ACSC’s ReportCyber tool, representing losses of over $142 million.”
How does it work?
Cybercriminals gain access to your phone, computer or website and monitor them, sometimes for a few weeks, waiting for the moment you send or receive an invoice. The email is then intercepted redirecting the invoice to the cybercriminal. The cybercriminals will then change the bank account information to their own and resend it often with a note or additional email bringing the ‘updated bank details’ to your attention. You or your clients being unaware of the interception, will then pay the invoice directly to the criminals bank account.
How to prevent it?
Being vigilant about who you are paying is the best approach. Keep an eye on the invoices you are sending or receiving and the bank information. If you notice any change in bank account information, contact the client or supplier directly via phone to confirm the new details.
Avoid opening emails from unknown sources. It is estimated that the average email user receives 67 spam and phishing emails each month. Opening these can unknowingly allow malware to infect your computer giving the cybercriminals direct access to your information.
What to do if this happens to you?
Your first step is to contact your bank. It may be possible to stop the payment if it has not already gone through. They will also be able to assist you further in the possible recovering of any funds.
Next, report the incident to the authorities and ReportCyber.
It is important to then change your passwords for any accounts that have been compromised. Strong passwords with a mixture of numbers, letters and symbols can make it harder for cybercriminals to access your information. While in most cases the BEC scam does not involve the use of viruses or malware, running an anti-virus software scan regularly can help protect your device. Ensure you also update your staff on the attack and have them update their log in details also. Use multi-factor authentication wherever possible to help secure your accounts.
Contact your clients and suppliers as soon as possible and advise them of the situation. This will help prevent others from falling victim to the scam also by paying the cybercriminal.
The Protecting Against Business Email Compromise publication, and other easy to follow cyber security information and advice, is available at cyber.gov.au. You can report cybercrime by going to www.cyber.gov.au and ReportCyber, providing a single online portal for individuals and businesses on behalf of federal, state and territory law enforcement agencies.