According to the findings of the Cyber Security Breaches Survey, half of businesses (50%) and around a third of charities (32%) reported having experienced some form of cyber security breach or attack during 2023. The bigger the business and wealthier the charity, the more likely an attack.
The type of attack most experienced was phishing. Next was others impersonating organisations in emails or online, and finally viruses and other malware.
The average cost to businesses affected was around £1,200; when medium and large businesses are looked at separately, the average rises to around £10,830. But that, of course, doesn’t take into account disruption, inconvenience, and loss of reputation. Clearly, cybersecurity breaches are something to be avoided if at all possible.
In this article we’re going to look specifically at business email compromise (BEC), which is a type of phishing attack. Of the organisations affected by a cyber security breach or attack during 2023, 84% of businesses and 83% of charities experienced such an attack.
What is BEC?
With BEC, criminals access a work email account to illicitly acquire money or data. BEC attacks usually target people in senior positions, or who can authorise money transfers. They might pretend to be someone else in the business and/or include information from an existing email thread to add legitimacy. They will pressure people to act swiftly. In the case of money, the intention is to trick the target into transferring funds into a bank account controlled by the criminal.
What do I do if I think I have lost money?
First up, don’t panic. Take action as soon as possible, starting with contacting your bank. When you do this, don’t use any details provided by the criminal in their communication, make sure you use verified contact details. Next, report the incident to the police, as it is a crime.
To report a scam, dial the number 159. This number will allow you to be put through to your bank safely and acts like a hotline to help eliminate fraud.
If the business has an IT department or contractor, see what help they can give. Also, check to see if any email accounts have been compromised. The National Cyber Security Centre (NCSC) have provided a ‘Check your cyber security’ tool to help with this: https://checkcybersecurity.service.ncsc.gov.uk/email-security-check
How do I reduce the likelihood of BEC?
Suggestions from the GreenStones team and the NCSC for reducing the likelihood of BEC includes:-
Reduce your digital footprint
Many organisations include ‘Meet the team’ sections on their website and post freely on social media. Individuals also post freely. However, information about senior team members can be harvested by criminals and used to make phishing emails more convincing. Encourage people to check privacy settings and to think twice before sharing confidential information.
Train team members to spot phishing attempts
You should provide your team members with information to help them recognise a fraudulent request. Also, give them the confidence to question whether an email is genuine, even if it appears to come from a senior person.
At GreenStones, team members treat unexpected emails with extreme caution. As a team we share snippets of spam emails internally, so others know what to look out for. This promotes and encourages our Share Relevant Knowledge value.
Set up 2-step verification
This extra step means even if a criminal gets their hands on your password, they won’t be able to access your accounts.
In addition, put in place internal verification procedures to confirm email requests.
At GreenStones we have recently implemented extra security on our computers to help protect and prevent any issues with our data.
On software’s such as Xero you can active a two-step authentication to increase your security.
Control payment privileges
Monitor and control the number of people able to make high-value payments. Revoke the privilege as soon as it is no longer needed.
What next?
The bad news is no matter how hard you try, you could still fall foul of an attack. The level of sophistication is increasing constantly, and preventative procedures are mostly reactive.
So, while you do need to do as much as you can to combat cyberattacks, you also need to consider how you will react should a breach occur. Conduct scenario planning, and then work out how you will respond, and practice that. Think of it like fire safety: you have safety procedures but you still have a drill so people know what to do should the worst happen.
Additional help is available from the National Cyber Security Centre (NCSC), which has published guidance intended to help small and medium-sized businesses deal with BEC. Read it here:
https://www.ncsc.gov.uk/guidance/business-email-compromise-defending-your-organisation