How to sidestep BEC scams targeting government

Earlier this month, the FBI issued a new warning about hackers targeting Microsoft Office 365 and Google G Suite with business email compromise scams. Long a top internet crime, BEC continues to wreak havoc in the public and private sectors even though basic cyber hygiene can go far to prevent it.

“It’s really rampant right now, and it’s going to continue to increase,” said Anne Connell, interactive design team lead at the CERT Division of the Carnegie Mellon University Software Engineering Institute. “Business email compromise is one of the top 10 internet crimes. It represents more than half of the total losses from those internet crimes -- and the complaints, there’s just more and more of them.”

BEC involves the use of deceptive techniques such as spearphishing, social engineering, identity theft, e-mail spoofing and malware to steal money from public- and private-sector organizations. Another method, Connell said, is whaling, in which perpetrators target individuals such as business or account managers who perform wire transfer payments.

In 2019, the FBI’s Internet Crime Complaint Center (IC3) received 467,361 complaints about crimes including BEC, with losses totaling more than $3.5 billion. BEC earned the No. 1 spot for the highest reported losses.

Several state, local and county governments were among the victims. In January, fraudsters stole $2.6 million from the government of Puerto Rico through a BEC attack. Late last year, Erie, Colo., electronically sent $1 million to a fraudulent account after an impersonator changed the payment preference method for the primary contractor on a local bridge project from check to electronic transfer. Similarly, last fall, Ocala, Fla., fell victim to a spearphishing email that looked like it came from a construction firm working on a new terminal at the city’s airport. The city lost more than $740,000. And in December 2018, Carrabus County, N.C., moved $2.5 million intended for building a new high school to a scammer’s account.

One reason for the persistent problem is a lack of resources, Connell said. In fact, BEC perpetrators have started targeting small and midsize organizations because they’re less likely to have protections in place.

“There are a lot of state and local and county governments that really don’t have the protection,” she said. “They might have one IT person, and they don’t have the budget to buy 14 different network appliances like Splunk and Carbon Black. They don’t have the money, they don’t the time, they don’t have the resources, they don’t have the people trained in order to do that, so it’s really easy.”

The best protections secure email clients by encrypting messages or indicating whether an email is from an internal or external source, Connell said. But there are many ways agencies can shore up their security without big budgets or IT staffs.

“If you don’t have a lot of money to spend on an organizational-wide training and awareness campaign, you can make use of a lot of resources that are freely available,” she said. “If you create a collection of these resources, you don’t have to pay for an expensive service.”

For example, IC3 recommends comparing the link in the email to the one it’s directing users to and logging in through the official website, rather than linking to it through the unsolicited email.

Plus, many email providers are themselves making changes. For instance, after attackers used what looked like a legitimate Microsoft email to ask users to close their accounts and start new ones, the company made its email tougher to impersonate and began offering two-factor authentication, Connell said.

Four indicators that could signal a BEC attack, according to a blog post Connell wrote, include large wire or funds transfers to a recipient the organization has not previously dealt with, transfers that start near the end of the day or right before weekends and holidays, a receiving account that has no history of getting large funds transfers and a receiving account that is a personal, rather than business, account.

Much of the defense against BEC starts with basic cyber hygiene, such as flagging email from a sender who uses a similar but slightly different domain name or an email with a “reply to” address that is different from the sender address. Using two-step or multifactor authentication for funds transfers will also help, as will implementing email authentication protocols and color coding incoming emails based on internal and external senders.

Another good idea is “adopting the practice of carefully scrutinizing all emails that request a transfer of funds simply by picking up the phone and ensuring that that vendor is asking for it,” Connell said. “Even if you don’t have an intrusion-detection system that will flag the emails, the fact is our users are the last line of defense,” she said. “But you have to give them more direction than just saying, ‘Avoid phishing.’”