Business Email Compromise vs. Phishing

The cybersecurity world is riddled with terms that seem to overlap, which can cause confusion when users are trying to learn more about the subject.

For example, all ransomware is considered malware, but not all malware is ransomware, and while all viruses fall under the umbrella of malware, not all malware is a virus. To make matters worse, sometimes organizations use the terms interchangeably when they really shouldn’t.

Another example of terms that can be confusing when compared to each other is business email compromise, also known as BEC, and phishing. Both are forms of cyberattacks, but they differ in their methods, targets, and objectives.

Business Email Compromise

BEC typically targets businesses, executives, or employees with access to financial or sensitive information. Organizations of all types, from all industries, and of all sizes can be targeted by BEC. Some cybercriminal groups target very specific organizations, and some will attack just about any they can gain a foothold inside.

In a BEC attack, the attackers usually impersonate a trusted individual, such as a CEO, vendor, or partner, by compromising or spoofing that person’s or organization’s email account. The attackers use that account that is generally trusted by the recipient to send highly targeted and convincing emails to manipulate the recipient into taking specific actions, such as transferring funds or sharing confidential data.

The objective of BEC attacks like this is financial gain or theft of sensitive business information. Attackers can find success in having an unsuspecting employee wire money directly into their account, or they can sell the information they obtain during the attack on the dark web.

BEC attacks are often more sophisticated and personalized, relying on social engineering rather than malicious links or attachments.

It is important to note that in traditional BEC attacks, the direct email approach spoofs executives, exploits organizational hierarchies, and uses urgent demands for financial payments and transfers. Sometimes, the cybercriminals go even further, developing elaborate deceptions that involve long and complex reply threads that are placed in their malicious emails with the correct executive names, and even their tone, to make their emails even more convincing.

Phishing

Phishing can target pretty much anyone, including individuals, employees, or businesses. Phishing is definitely more of a broad approach where thousands of emails are sent to thousands of email addresses without any real consideration of who the recipients are in most cases. Phishing is definitely more of a numbers game – the more phishing emails sent, the better the chance someone who receives the email will click on the malicious links or attachments in the email.

Attackers still attempt to ensure these mass emails or messages appear to come from legitimate sources like a bank or online service provider in order to trick recipients into clicking on malicious links, downloading malware, or providing sensitive information like passwords or credit card details.

The objective of phishing is to steal credentials, spread malware, or commit financial fraud. Attackers can use credentials to attempt to transfer money out of accounts or use access to steal information that can be sold. Sometimes phishing attacks will contain ransomware that is designed to lock critical business systems or even a personal laptop until the victim pays a ransom to unlock their device or servers.

Phishing attacks are often less targeted and less sophisticated, relying on volume, hoping to trick as many people as possible.

Key Differences

Most notably, the scope of these two attacks is quite different. BEC is highly targeted and specific, while phishing is broader and more generalized. When it comes to tactics, BEC relies on impersonation and social engineering, whereas phishing often uses malicious links or attachments. BEC generally targets businesses and high-value individuals, while phishing can target anyone. In short, BEC is a more focused and strategic form of attack, while phishing casts a wider net to exploit as many victims as possible.

Knowing the Difference

It is important that organizations know the difference between these two types of attacks because while there may be some overlap in solutions that can be used to combat BEC and phishing, knowing whether your organization is currently being targeted for BEC by a cybercriminal group, or simply being phished allows you to deploy your security resources accordingly. Phishing emails can just show up in inboxes, but BEC attacks tend to also use more than one attack method. BEC attacks naturally can start with malicious emails, but they can also progress to fraudulent phone calls, voice mail messages, instant messages, and other forms of social engineering.

Combatting Phishing Attacks

Fighting phishing attacks effectively requires a combination of awareness, technology, and best practices by every user, whether they are in an office, working on secure in-house systems, at home using their personal laptop, or somewhere in between like working remotely. Here are some of the best ways to protect yourself and your organization from phishing attacks:

• Educate and Train Users: Conduct regular training sessions to help employees and users recognize phishing attempts. Teach them to identify suspicious emails, links, and attachments. Encourage skepticism of unsolicited requests for sensitive information.
• Verify Before Clicking: Always verify the sender's email address and domain. Hover over links to check their destination before clicking. Avoid clicking on links or downloading attachments from unknown or untrusted sources.
• Use Multi-Factor Authentication (MFA): Enable MFA for all accounts to add an extra layer of security. Even if credentials are compromised, MFA can prevent unauthorized access.
• Implement Email Security Tools: Use spam filters and email security solutions to block phishing emails. Enable Domain-based Message Authentication, Reporting, and Conformance (DMARC) to prevent email spoofing.
• Keep Software Updated: Regularly update operating systems, browsers, and antivirus software to patch vulnerabilities. Use reputable antivirus and anti-malware tools to detect and block threats.
• Encourage Reporting: Create a simple process for employees or users to report phishing attempts. Act quickly to investigate and mitigate reported threats.
• Monitor and Test: Conduct simulated phishing campaigns to test and improve user awareness. Monitor network activity for unusual behavior that could indicate a phishing attack.
• Secure Sensitive Information: Limit access to sensitive data to only those who need it. Use encryption to protect data in transit and at rest.
• Be Cautious with Public Wi-Fi: Avoid accessing sensitive accounts or entering credentials on public Wi-Fi networks. Use a Virtual Private Network (VPN) for secure connections.
• Stay Informed: Keep up with the latest phishing tactics and trends. Share updates and alerts about new phishing scams with your team or community.

By combining these strategies, you can significantly reduce the risk of falling victim to phishing attacks.

Combatting Business Email Compromise

To effectively combat BEC, organizations need to adopt a multi-layered approach combining technical measures, employee training, and robust processes. Here are some key strategies:

• Employee Training: Regularly educate employees about phishing and BEC tactics. Teach them to verify sender information and recognize red flags like urgent financial requests.
• Email Authentication Protocols: Implement protocols like DMARC, SPF, and DKIM to prevent email spoofing and ensure email authenticity.
• Multi-Factor Authentication (MFA): Enforce MFA for all email accounts to add an extra layer of security, even if passwords are compromised.
• Verification Processes: Establish strict procedures for verifying financial transactions, such as callbacks to confirm payment requests using known contact details.
• Software Updates: Keep all systems, including email servers and antivirus software, updated to protect against vulnerabilities.
• Incident Response Plan: Develop and regularly update a plan to handle BEC incidents, including isolating systems and notifying authorities.
• Email Encryption: Use encryption to secure email content, making it unreadable to unauthorized parties.
• Financial Controls: Implement two-step verification for sensitive transactions to minimize risks.
• Monitoring and Audits: Conduct regular security audits and monitor email systems for unusual activities.
• Domain Protection: Use tools to monitor and protect your domain from spoofing and lookalike attacks.

By fostering a culture of cybersecurity awareness and implementing these measures, businesses can significantly reduce the risk of falling victim to BEC.

The Bottom Line

While some solutions available can help organizations with both types of attacks, and some of the steps needed to combat them are very similar, it is important to remember that business email compromise and phishing are two distinct types of attacks. Organizations must prepare for both. Mimecast stands ready to help customers with customized solutions geared to protect against both business email compromise and phishing.