Fraud | September 2024 How to detect and defend against business email compromise

In a business email compromise attack, a fraudster impersonates or takes over the account of a trusted employee, vendor, or federal agency. Its success depends on how convincingly it can imitate the account being impersonated. If it works, your employees might hand over sensitive data (including passwords), transfer funds to criminals, or click malicious links that can compromise your computer network.

Case study: Comparing email addresses helps pharmacy stop a BEC attack. When an order for $500,000 in prescription medications came in from a large medical center, pharmacy staffers carefully checked the details.^{Disclosure 4} Even though the paperwork looked valid, one employee noticed the email address didn’t match the one on file. When the employee called the medical center, a representative told them the order was a sham.

Anyone can be the target of business email compromise. Knowing what signs to look for—and what actions to avoid—can help keep your employees from falling victim. Here are some common strategies for preventing BEC attacks.

Train staff to double-check email addresses and message details.

BEC scammers often imitate the email addresses of real employees or business associates. The giveaway may be something as small as one- or two-letter inconsistencies in the username or a misspelled domain after the @. These imposter emails often express urgency, arrive at odd hours, appear to come from an executive or person of authority, and may request secrecy or reference an unfamiliar project.

Limit what you publicize about employees, roles, and email addresses.

Every BEC attack relies on access to employee details such as names, titles, and email addresses. Only share that information with trusted partners—and encourage them to report any suspected attacks, whether attempted or successful.

Require strong passwords and multifactor authentication.

Sometimes, hackers will take over the actual email account of someone you trust and then send emails directly from them. When used properly, passwords and multifactor authentication (MFA) can go a long way towards preventing this. Educate employees to create and protect strong passwords, change them regularly, and use MFA to provide an extra layer of security against password theft.

Make dual control a number one priority.

Implement dual control policies to help identify spoofs, inconsistencies, and other red flags that indicate BEC attacks. With dual control, two eagle-eyed experts in your company must approve any requests for sensitive information like banking details or credential sharing.

When in doubt, talk to Truist.
There are certain requests we will never make of our customers. If you’ve received an email, text, or voice message asking for private banking details like your account number, routing number, or PIN, reach out and alert your relationship manager. Our fraud prevention experts can help identify, report, and neutralize any phishing attacks.