Phishing and Business Email Compromise: What to Watch For

Email is essential for most businesses. Employees use it to communicate with customers, approve purchases, receive invoices, share documents, and manage daily operations.

Unfortunately, criminals know how much businesses rely on email too.

Phishing and business email compromise (BEC) scams are designed to make fraudulent messages appear legitimate. An email may look like it came from an executive, employee, vendor, bank, or other trusted source. However, one convincing message can lead to stolen login credentials, exposed information, or fraudulent payments.

Therefore, employees at every level should know the warning signs.

What Is Business Email Compromise?

Business email compromise is a type of fraud that uses email to trick someone into sending money or sensitive information.

According to the Federal Bureau of Investigation (FBI), BEC scams often involve messages that appear to come from a known source making a legitimate request.

For example, a criminal may impersonate a vendor and provide new payment information. Another scam may appear to come from a company executive asking an employee to purchase gift cards or make an urgent payment.

The FBI identifies BEC as one of the most financially damaging online crimes.

Look Closely at the Sender

First, do not rely only on the name displayed in an email.

Scammers can use an email address that looks almost identical to a legitimate one. For example, they may change a single letter, number, or symbol in a company name.

Therefore, employees should carefully examine the complete sender address, especially when an email involves money, passwords, account information, or sensitive documents.

Also, watch for unexpected changes. A vendor who normally communicates from one address but suddenly uses another deserves additional verification.

Be Suspicious of Urgency

Next, pay attention to the tone of the message.

Phishing and BEC scams often try to create urgency. The sender may claim that a payment must be made immediately, an account will be suspended, or a confidential request needs to be completed before the end of the day.

In addition, the sender may ask you to bypass normal procedures or keep the request secret.

Urgency can encourage people to act before they have time to think. Therefore, an unexpected request to move quickly should be treated carefully.

Verify Changes to Payment Information

A request to change payment instructions deserves special attention.

For example, an email may appear to come from a familiar supplier but ask that future payments be sent to a different bank account.

The FBI recommends verifying changes in account numbers or payment procedures directly with the person or company making the request.

However, do not rely on the phone number included in a suspicious email. Instead, use a phone number or contact method that your business already knows is legitimate.

Adding a second approval step for significant payments can provide another opportunity to catch fraud before money leaves the business.

Think Before Clicking Links or Attachments

Phishing emails may also contain links or attachments designed to steal information or install malicious software.

For example, an email might claim that an employee needs to reset a password, review an invoice, open a shared document, or confirm account information.

Before clicking, consider whether you were expecting the message.

The FBI recommends avoiding links in unsolicited messages asking you to update or verify account information. Instead, go directly to the company’s official website or application.

Similarly, employees should be cautious with unexpected attachments, even when the message appears to come from someone familiar.

Use Multifactor Authentication

Passwords alone may not provide enough protection for important business accounts.

Therefore, businesses should enable multifactor authentication (MFA) when it is available. MFA requires another form of verification in addition to a password.

The FBI recommends using two-factor or multifactor authentication and advises users not to disable it.

In addition, employees should use strong, unique passwords for business accounts. Reusing passwords across multiple services can increase the damage if one set of credentials is stolen.

Make Employee Awareness Part of Business Security

Technology is an important part of security. However, employees also play a major role.

Businesses should establish clear procedures for handling suspicious emails, payment changes, password requests, and unexpected messages from executives or vendors.

Employees should also know who to contact when something does not look right. Most importantly, they should feel comfortable verifying a request instead of acting simply because an email appears urgent.

Physical and digital security also work best when businesses take a layered approach. Cultris Security Systems provides commercial security solutions that can help protect facilities, employees, equipment, and other valuable business assets. To learn more, visit our site.

Know What to Do if a BEC Scam Succeeds

If an employee discovers that money was sent because of a fraudulent email, acting quickly is important.

The FBI recommends immediately contacting your financial institution and asking it to contact the financial institution that received the transfer.

In addition, businesses can report BEC and other internet crimes to the FBI’s Internet Crime Complaint Center at IC3.gov.

If login information may have been exposed, the affected account should also be secured promptly. Follow your organization’s cybersecurity procedures and involve the appropriate IT or security personnel.

Finally, document what happened. Reviewing how the scam reached an employee can help your organization identify weaknesses and improve procedures.

Slow Down, Verify, and Protect Your Business

Phishing and business email compromise work because fraudulent messages can look surprisingly normal.

Therefore, employees should pay attention to small details. Check sender addresses, question unexpected urgency, verify changes to payment instructions, and be cautious with links and attachments.

Most importantly, create a workplace culture where verification is expected. Taking an extra minute to confirm an unusual request can prevent a much larger problem.

Business security should protect both your people and your property. Cultris Security Systems can help strengthen your facility with commercial intrusion detection, access control, video surveillance, monitoring, and other customized security solutions. Call 281-506-8466 or visit www.cultrissecurity.com to learn more.