A malicious third party will usually an account with an email address that resembles the one on the organisations domain name, so that he can establish trust between the victim and their own email.

Sometimes this technique that we call BEC Scam is referred as a “man-in-the-email attack”.

The most common cases involve malicious third parties focusing their attention to the employees who are in control of company finances, such as accountants or personal secretaries and perform various techniques to trick them into issuing wire transfers to their bank accounts while they try to maintain trust, but in reality the money is paid to the scammer’s bank account.

Although the perpetrators of BEC use a combination of tactics to trick their victims, a common plan involves the attacker gaining access to a business network utilising a spear-phishing attack in conjunction with some form of malware. If the attacker stays undetected, they can spend time studying all facets of the organisation, from vendors, to billing systems, to the correspondence habits of executives and other employees.

At an appropriate time – usually when the employee being impersonated is out of the office – the attacker will send a bogus email to an employee in the finance department. A request is made for an immediate wire transfer, usually to any trusted vendor. The targeted employee thinks the money is being sent the expected account, but the account numbers have been altered slightly, and the transfer is actually deposited in the account controlled by the criminal group.

If the money fraud fails to be spotted in a timely manner, the funds can often be close to impossible to recover, due to any number of laundering techniques that transfer the funds into other accounts.