Can you tell the difference between your colleagues and a scammer with access to their email account? This is essentially what a business email compromise attack involves—a scammer initiates a phishing scheme using an internal mode of communication. These scams are also observed in schools, making them dangerous in the education sector.

Today, we’re exploring how to navigate these attacks safely and what’s at stake if you don’t.

How BEC Works

Most employees won’t think twice if they receive a request for information—especially if it comes from a trusted company entity.

Business email compromise is an attack that uses an essential business communication tool to fool the victim into handing over the information directly. In some cases, the attacker might even receive direct access to the information they seek. There are no two ways about it—this situation is bad, full stop.

Here’s how it works:

1. A scammer will select a target, research it, and potentially even craft a fraudulent website to make their efforts that much more effective.
2. The scammer then breaches the company’s email systems and identifies the most effective targets based on the emails they send and conversations they hold.
3. Spoofing an email domain, the scammer prepares to impersonate the right person to influence their target.
4. The scammer then contacts the target, working to build up enough trust to make the ask—whether for money (often in the form of gift cards) or data.

These attacks are increasingly becoming more significant problems for schools and educational institutions.

Public Sector Organizations Are At Risk

Schools and public institutions find themselves the target of these attacks for a couple of reasons:

• Many such organizations have only a limited budget for cybersecurity, making them more likely to be targets of a cyberattack.
• These organizations also commonly exchange large amounts of capital regularly, giving an attacker more opportunities to strike.
• Many of these organizations also rely on complex administrative structuring and processes, making them even more vulnerable as issues are missed and the right people are required to sign off on any action.
• The public sector also typically collects a lot of data throughout its operations, which means that a cybercriminal would be interested in obtaining these stores.

It makes sense that schools in California and Tennessee have been targeted by these attacks, given how much hackers stand to gain from a successful strike. These institutions can sustain damages of up to six or even seven figures. But those are just the direct costs, not to mention the other damages to reputations and penalties.

All of these are reasons to consider your own approach to securing your business from BEC attacks.

What You Can Do to Mitigate Business Email Compromise

We recommend that all Bay Area & Northern California businesses take the following security precautions for BEC:

• Adequately protect financial data and other sensitive information. A precautionary audit can help you determine what is at risk and where your vulnerabilities lie.
• Consider a cyber insurance policy. Cyberattacks are more commonplace than natural disasters these days, so you should have plans in place to protect you against the financial costs that could result (just make sure you know what’s covered and what limits exist).
• Prioritize compliance. All businesses are subject to certain compliance requirements, and failing to maintain the standards required by government or industry could result in hefty fines should your business fall victim to a scam.
• Monitor your infrastructure at all times. There are tools out there that can help you detect BEC attacks before they become a problem—like, say, a compromised account before it can be leveraged against your staff.

With these measures in place, we’re confident you’ll be in a much better position to identify and prevent BEC attacks.

If you’re worried about your business’ security, you can rely on 415 IT to keep you safe. Learn more today by calling us at (415) 295-4898.