Exploiting trust for financial gain: an overview of business email compromise (BEC) fraud

Abstract

Purpose This paper aims to explore current knowledge of business email compromise (BEC) fraud, or approaches that specifically target organisations for financial gain, through the exploitation of trusted relationships. BEC fraud affects organisations globally and is estimated to have netted offenders over US$26bn since 2016. Despite the sheer magnitude of these losses, there is a dearth of academic research seeking to better understand this crime type, and prevent it from occurring. Design/methodology/approach This review summarises the known literature on BEC fraud. It uses a variety of academic and industry sources to ascertain the current state of knowledge, including how it is perpetrated, its impact (on businesses and individuals), how law enforcement have responded and its prevention. Findings This review highlights many gaps in knowledge surrounding BEC fraud. There has been a large focus on the technical aspects of BEC fraud, to the detriment of the human elements. Often, BEC fraud is successful through targeted and effective use of social engineering techniques and is able to overcome any technical solutions through the manipulation of personal relationships. Further, while the financial impacts of BEC fraud are obvious, there is no known research which has explored the non-financial harms of BEC fraud (across organisational and individual perspectives). With companies starting to (unsuccessfully) take legal action against those who have responded, there is a clear need to understand how organisations can better respond to incidents when they occur. Finally, there are gaps in knowledge on what is the best combination of both technical and human measures to prevent BEC fraud. Research limitations/implications This review is based on information presently available, and as indicated, there are significant gaps in what is currently known. Practical implications This review highlights the need to undertake research into the current gaps, with a view to improving best practice knowledge on prevention and response. Social implications Currently unknown, BEC fraud is posited to have significant impacts at both personal and collective levels. Increased knowledge of these non-financial impacts will improve how organisations respond to BEC fraud and how employees can be supported before and after an incident occurs. Originality/value Despite the magnitude of the problem, there is limited academic scholarship on BEC fraud. This literature review offers a summary of current knowledge and advocates a strong research agenda moving forward.

Machine Learning in Financial Market Surveillance: A Survey

“…Flexibility in building deep learning models by adding new features, such as neural layers, connections and objective functions, provides plenty of room to explore in this direction. Another future research direction is Deepfake [87], a synthetic content generation technology based on generative deep learning [88], that has recently made it possible to manipulate financial markets by digital impersonation [89], [90]. Detection of deepfakes is a technical challenge [87].…”

A deeper look into cybersecurity issues in the wake of Covid-19: A survey

“…Perpetrators' tactics are dubiously effective, and the financial losses sustained by businesses can be crippling. According to the information presented in this analysis, there is a global upsurge of fraud victimization and losses associated with fraud Internet Crime Complaint Centre (ICCC) and BEC fraud seem to be adopting that trend ( Cross & Gillett, 2020 ).…”

“…Business Email Compromise (BEC) threats are one of the most financially devastating types of cybercrime ( Greathorn.com, 2021 , Cross and Gillett, 2020 , Cross and Kelly, 2016 ). They often use social engineering strategies and phishing emails to infiltrate organizations and fool unwary employees and executives into performing tasks that appear to come from a trustworthy sender, frequently posing as legitimate business activities.…”

“…In a recent BEC report by “Cybersecurity Insiders” found in Greathorn.com, 2021 , Cross and Gillett, 2020 : (i) the most popular type of BEC attack is a spoofed email accounting for 71%, followed by spear-phishing, which was 69%. Furthermore, (ii) more than half of links received via email lead to a malicious site (iii) 57 % of malicious links in phishing emails intend to steal credentials.…”

İşletmelerin Kâbusu: İş E-Postası Dolandırıcılığı (BEC)

“…Bilgisayarlarında yapılan incelemede 50'ye yakın dolandırıcılık bulgusuna ulaşılır. 2 BEC dolandırıcılığı açısından, hem şirketler hem de bireyler hakkında kamuya açık bilgilerin mevcudiyeti, motive olmuş bir suçlu için çok sayıda potansiyel hedef sağlamaktadır(Cross ve Gillett, 2020).3 Bu örnek Barış Terkoğlu tarafından 30 Ocak 2020 tarihli Cumhuriyet Gazetesi'ndeki köşe yazısından alınmıştır(Terkoğlu, 2020).Ses ile gerçekleştirilen dolandırıcılıklara karşı yazılım üreten bir işletme 2013 yılından günümüze ses taklidi ile gerçekleştirilen suçlarda %350 artış olduğunu ifade ettiler. Yapılan analizlerde bir işletmeye gelen her 638 telefon görüşmesinden birinde yapay olarak oluşturulan ses kullanıldığı belirtilmektedir.…”