The Invoice Isn’t Real: Protecting Your Business from Business Email Compromise (BEC)
Your employee receives an email that looks like it’s from you. It’s marked “URGENT” and asks them to immediately pay an invoice to a new supplier. The employee, wanting to be helpful, makes the payment. A few days later, you discover the money is gone, and the email was a fake.
This scenario is a classic example of Business Email Compromise (BEC), one of the most financially damaging scams targeting small businesses today. Unlike typical phishing emails that just want a password, the goal of a BEC attack is direct, immediate financial theft.
How Does a BEC Attack Work?
Criminals use sophisticated social engineering to build trust. They might:
- Impersonate a Senior Executive: They “spoof” an email address to make it look exactly like it’s coming from a director, often using urgent language to pressure an employee in the finance department.
- Take Over a Supplier’s Account: They might hack into the real email account of one of your trusted suppliers and send you a fake invoice with their own bank details on it. Everything looks legitimate because it’s coming from a real account.
How to Protect Your Business
Technology is part of the solution, but human process is your strongest defence.
- 1. Implement a Verbal Confirmation Process: Create a strict, mandatory policy that any request to change bank details or make an urgent, unscheduled payment must be verbally confirmed over the phone, using a known, trusted number. The person making the payment must be the one to initiate the call.
- 2. Train Your Team to Be Suspicious: Educate your staff about this specific type of scam. Encourage a culture where it is okay to question and double-check a request, even if it appears to come from the CEO.
- 3. Enhance Your Email Security: While not foolproof against these scams, advanced email security filters can help flag suspicious emails. Enforcing Multi-Factor Authentication (MFA) also makes it much harder for criminals to take over real email accounts in the first place.
This is one threat where a simple process change can save your business tens of thousands of pounds.
My free IT & Cybersecurity Audit for North East businesses includes a review of your processes and technical defences to ensure you are protected against threats like BEC.