This advice has been collated by EMSOU and is intended for wider distribution within the East Midlands Region to raise awareness among businesses and the public.

Advice and information is changing daily as we navigate our way through the COVID- 19 pandemic, so please ensure you only take information from reputable sources. If you require any further information, assistance or guidance please contact the EMSOU Protect Team or your local Force protect team. In today’s blog, we’re looking at Business Email Compromise (BEC), a form of phishing attack crafted to appeal to specific individuals, which can be even harder to detect than typical phishing emails.

The attackers attempt to defraud the company, its customers, partners, and/or employees into sending money or sensitive data to the attacker’s account. Read on for advice on how to identify these types of communications, how to train your staff to deal with them and how to best prevent sensitive information being leaked to the scammers:

Examples of BEC

The Bogus Invoice Scheme: An attacker pretends to be the supplier and requests a funds transfer to an account the attacker controls. Companies with foreign suppliers are often targeted with this tactic.

CEO Fraud: Attackers pose as an executive and send an email to employees in finance, requesting that they transfer money to a bogus account. Often requested as a matter of urgency and when the CEO may be otherwise engaged.

Account Compromise: An executive or employee’s email account is hacked and used to request invoice payments to vendors listed in their email contacts.

Impersonation: When a legal representative’s e-mail address is used to contact clients, asking that they pay money to an account controlled by the attacker.

Data Theft: Employees are targeted to obtain Personally Identifiable Information (PII) of employees and executives. Such data can then be used for future attacks.