Business Email Compromise Scams: How To Protect Your Business From Email Imposters

Jashmine Desai| Compliance Assistant- Compliance

Email is the primary communication tool used in businesses today and any vulnerability in the system can have serious consequences. Businesses are increasingly facing a new threat in the form of email compromise. As technology becomes more sophisticated, criminals have become adept at exploiting email systems to extract confidential information or otherwise exploit businesses. Unfortunately, these attacks can cause serious financial and reputational damage to organizations, and understanding the risk and how to take action is paramount for business leaders today.

What is a Business Email Compromise?

Business Email Compromise is a type of cyber-attack in which someone with malicious intent uses a spoofed or otherwise manipulated email to deceive an employee of a company or organization. The attacker is usually attempting to access sensitive data or divert funds from the company and will use the fraudulent emails to influence unsuspecting employees into taking action. Business Email Compromise attacks can involve a wide variety of techniques such as phishing, social engineering, spoofing, and malware deployment.

The risk to your business 

Business Email Compromise scams have caused businesses to lose millions of rands. These scams often target businesses that handle large amounts of money or sensitive information, work with foreign suppliers, have high-value wire transfers or rely on email to transfer sensitive financial or customer data. The attacker will use the compromised email account to request funds transfers, steal sensitive information, or spread malware.

Victims of Business Email Compromise scams can suffer from:

• Financial loss: Business Email Compromise attacks often involve tricking people into making unauthorised financial transfers, which can result in significant financial losses for the business.

• Reputational damage: Damage to your business’s reputation, as customers and other stakeholders may question your information security.

• Legal liability: If a Business Email Compromise results in an unauthorised funds transfer, you may face legal action from the affected parties.

• Disruption of operations: It can disrupt your business’s normal operations, as your personnel would be forced to devote time and resources to resolving the issue and recovering from the attack.

• Loss of sensitive information: Business Email Compromise attacks often involve the theft of sensitive information, such as confidential business data or personal information of employees and customers and trade secrets. The theft can severely affect the privacy and security of individuals and businesses and may be used to launch further attacks.

How to prevent a Business Email Compromise

1. Hierarchical approach: A company’s directors must be aware of the risks of a Business Email Compromise and actively guide the business’s strategy in this regard. There’s a close link between data protection, information security, and business continuity and a Business Email Compromise.

2. Raise employee awareness: Educate your employees about email security. It is important to ensure that your employees are familiar with email security best practices and are aware of the risks associated with email imposters.

3. Enforce strong authentication: Require employees to use multi-factor authentication, such as a password and a security token, to access email accounts and other sensitive systems.

4. Monitor email activity: Monitor email activity for signs of suspicious behaviour, such as unexpected emails from known contacts or requests for sensitive information or funds or unusual source IP addresses and large file attachments. If an employee notices any emails that seem suspicious or don’t look genuine, they should be sure to report them to the proper authorities or IT personnel.

5. Email encryption: Encrypt all sensitive information sent via email to prevent attackers from intercepting it. This will help to ensure that if your emails are intercepted or stolen, the contents of your emails will not be accessible to the imposters.

6. Maintain up-to-date software: Keep all software, including email client and anti-virus software, up to date to ensure that vulnerabilities are patched promptly.

7. Back up of data: Implement a backup strategy for emails and other data. Regularly back up all critical data and store it in a secure location, such as an off-site server, to minimise the impact of a Business Email Compromise attack.

8. Implement email security controls: Utilise anti-malware, email spoofing detection and phishing prevention solutions.

9. Develop a Security Policy: Adopting a security policy outlines user access, data storage and passwords. Enforce strong account passwords and regularly changing of passwords.

10. Conduct regular security audits: Conduct regular security audits to identify potential vulnerabilities and ensure that security measures work as intended. Review and update security policies regularly.

A Business Email compromise can have a devastating impact on a business. Companies that fall victim to these scams can lose thousands and even millions in financial losses. Even with increased security measures the threat of a Business Email Compromise is still a real danger that companies must be aware of in order to protect their sensitive and confidential information. With careful planning and diligent security businesses can greatly reduce the risk of becoming victims of a Business Email Compromise.