Business Email Compromise, or BEC, is a growing threat that can directly impact your bottom line. These attacks are highly targeted and use tactics like impersonation and social engineering to trick employees into transferring funds or disclosing sensitive business information.
Unlike typical phishing scams that cast a wide net, BEC attacks are carefully planned and personal. Attackers take the time to learn about your business, pretend to be trusted vendors or company leaders, and convince your team that their fake requests are actually legitimate. Around the world, BEC is one of the most costly types of cybercrime, leading to billions of dollars in losses every year. In 2024 alone, these scams resulted in $6.3 billion in losses globally, with each incident costing an average of $50,000.
Knowing what to look for and acting quickly can make all the difference. Here are five warning signs that your business might be at risk:
1. Your Organization Handles Large Sums of Money
If your business regularly sends large wire transfers, makes international payments, or deals with high-value transactions, you're already a target for cybercriminals. Industries like manufacturing, energy, real estate, and healthcare are often at higher risk due to the size and complexity of their financial operations.
Cyber attackers often create very convincing emails that look just like real invoices or payment requests. All it takes is one compromised transaction and your organization could face losses in the hundreds of thousands, sometimes with no way to recover the funds. Staying ahead of these threats is essential for protecting your organization's financial health.
2. Your Leadership Team Is Easy to Find Online
By scanning press releases, social media, and online videos, cyber criminals are able to gather details about your leadership team and anyone who manages or approves financial transactions. The more visible your leadership is, the greater the chance that someone might try to impersonate them.
For example, you might get an urgent email that looks like it's from your CFO asking for a wire transfer while they're traveling. At first, it can seem completely legitimate, but these messages are often carefully-timed scams that are designed to gain your trust and bypass your usual security checks.
3. Your Business is in the Middle of a Major Change
Whether it's a merger, acquisition, restructuring, or leadership transition, change creates chaos where attackers can thrive. During these periods, normal controls may not be enforced, new people are introduced, and communication can come from unknown sources. All of this makes it easier for fake invoices or payment instructions to pass by unnoticed. For example, a scammer might pretend to be a lawyer involved in a deal and send fake wire transfer instructions just before closing.
4. Low Investment in IT
Mid-sized companies are especially at risk when it comes to online security. With smaller IT and security training budgets, the risks associated with an attack increase. Even with basic email protections and training in place, attackers find success using AI to create sophisticated phishing emails. Another established tactic is the use of email forwarding rules to bypass normal security controls. These messages can easily get past traditional security filters because they are designed to trick people, not just technology.
Take a moment to consider your current security practices. Is your finance team trained to carefully verify any changes in payment instructions? Do you require multi-factor authentication on email accounts to add an extra layer of protection? Do you have controls in place to detect and prevent social engineering tactics? If the answer to any of these questions is no, your organization could be an easy target for attackers.
5. You've Already Had a Close Call
A lot of businesses don't realize they have been targeted until it's too late and money is already missing. Some might brush off warning signs like suspicious emails or unexpected payment changes as one-off mistakes. However, these are usually clear signals that attackers are paying close attention. Once they find a weak spot, cyber attackers typically return with more advanced tactics and higher stakes.
What You Can Do
The risk of Business Email Compromise can be reduced, but it takes commitment from your organization's leadership. At UHY, we partner with businesses to identify risks and strengthen controls, so you can respond quickly and confidently when threats arise. Our Technology, Risk, and Compliance team brings together extensive experience in financial regulations and a strong understanding of BEC threats, tailored to the unique challenges of your industry. We can help ensure that your response to a BEC threat is not only effective but also fully aligned with the necessary standards.
If you suspect you're being targeted, or just want to make sure that you aren't next on the list, contact us for help.
Have a Question?
Complete this form to ask our professionals a question.
By submitting this form, you agree to be contacted by UHY.
TY COFFEE
Principal, UHY Consulting
Ty Coffee is a Principal with UHY Consulting, providing solutions that strengthen organizations. He brings over 19 years of experience managing, performing, and delivering information technology security solutions. This experience includes technology risk management, IT audition, IT security assessments, internal auditing, attack‐and‐penetration testing services, and security analysis in domestic and global entities.