Business email compromise: how it works and how to stop it

The three versions

The FBI’s Internet Crime Complaint Center has listed business email compromise among the costliest crimes reported to it year after year, with losses in the billions of dollars.

• Forged sender. A message that appears to come from your exact address, possible when your domain has no enforced DMARC policy. In our October audits, 29 of 33 Grand Strand business domains we checked didn’t stop this.
• Look-alike domain. Mail from huttenlochertec.com instead of huttenlochertech.com. DMARC can’t stop this; a careful eye and a process can.
• Taken-over mailbox. The criminal logs into a real account, usually with a phished or reused password, reads mail for weeks, sets up forwarding rules, and sends the fake invoice from inside the real conversation at the right moment.

What stops it

1. A rule for moneyAny new or changed bank details are confirmed by phone, using a number you already had, never the one in the email. Write it down, tell your customers and vendors you follow it, and put it on your invoices.
2. Two-step sign-in on every mailboxMost takeovers start with a password. A second step blocks nearly all of them.
3. DMARC at rejectSo nobody can send from your exact domain. See how to set up DMARC.
4. Check for forwarding rulesAttackers add rules that forward or hide replies. Review mailbox rules and connected apps every few months.
5. Register obvious look-alikesThe common misspellings and other endings of your domain, pointed at your real site.
6. Tell your customersA short line in your signature and on invoices: “We will never change our bank details by email.” Our fraud warning text has wording to copy.

If it already happened

• Call your bank immediately and ask for a recall of the transfer. Speed matters most here.
• File a report at ic3.gov.
• Change the mailbox password, sign out every session, turn on two-step sign-in, and check for forwarding rules.
• Call us or another incident responder to find how they got in and what else they saw.