Email continues to be the top route used by cybercriminals to target victims and business email compromise (BEC) is gaining traction as one of the preferred types of email attacks.

In 2019, a Lithuanian national spent two years posing as a third party who conducted business with two of the world’s largest digital platforms. The fraud was complex and the tech giants’ money took a round – the – world trip to be laundered before ending up in the impersonator’s bank accounts. The victim companies wired funds to bank accounts in Latvia and Cyprus, and quickly these funds were wired to different bank accounts in various locations throughout the world. The impersonator forged invoices, contracts and letters that falsely appeared to have been executed and signed by executives and agents of tech giants and submitted to the banks in support for large volume of funds that were fraudulently transmitted via wire transfer. Collectively, the victim organisations lost about $125 million.

For such a complex fraud, its origins were deceptively simple – a business email sent to victims. According to the US FBI’s Internet Complaint Centre, or IC3, BEC-is a sophisticated scam targeting both businesses and individuals performing wire transfer payments. The scam is frequently carried out when a subject compromises legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds. Scammers and cybercriminals have a variety of tricks up their sleeves to try to obtain financial or personal information from their victims.

The total value of funds redirected as a result of a BEC scam is now estimated to be $12 billion, according to the recent FBI data. Between December 2016 and May 2018, the world witnessed a 136 percent increase in BEC scam losses with instances of the crime being reported in over 150 countries.

The prerequisite to carry out a BEC fraud is simple. All that cybercriminals need is a computer and an off shore bank account in which the money can be transferred. They usually tend to have bank accounts in countries with less evolved regulatory frameworks and a limited experience of cross border collaboration on tracking the source of funds.

Most of the BEC scams rely solely on social engineering. It’s the use of trickery, deception, and psychological manipulation rather than malware which results in success. Since most network defence solutions are designed to detect emails containing malware and malicious links, BEC emails often land directly in users’ inboxes. And when this happens, the fate of an attempted BEC scam is in the hands of its recipient.

A popular streaming giant with more than 130 million subscribers, film buffs and TV show aficionados – is a hit with cybercriminals. A number of fraud emails were circulated in 2018, urging recipients to update their payment information to avoid having their account suspended. The link in the email lead to a convincing looking website that stole the target’s username, password and payment information.

Since socially engineered attacks such as BEC are designed to exploit human instincts and emotions, human-powered intelligence naturally plays a critical role in defending against these attacks. Unless properly equipped, businesses will have a hard time preventing such attacks.