Let me tell you a True Story about a Business Email Compromise BEC.

It was one of those calls that I sometimes dread not knowing entirely what to expect.  

The caller was not a client, but it was a local small business that I was familiar with. They had discovered that someone may have... as they said "hacked" their email and as a result the hacker executed a strategic con that eventually resulted in the business electronically transferring over $150,000 dollars to the hacker.   This type of breach is called a Business Email Compromise which is one of the most common cybercrimes that has now become a billion-dollar payday for cyber criminals.  

Business Email Compromise Cost - Image Source Darkreading.com

I don't fault anyone for falling prey to these schemes as the bad guys have gotten extremely cunning and skilled at pulling off this kind of theft.  The criminal organizations even employ lawyers, linguists, hackers and social engineers in order to pull off many forms of modern-day cons and deception.  These are not small groups but are large business enterprises employing thousands. This is a global multifaceted problem working at many levels of sophistication and is a serious threat that continues to escalate year over year.  

Cybercriminal Tactics:  
There are a handful of ways cyber criminals get their foot in the door, I will focus on the two that I see happen most frequently. 

First: Email Phishing or Spear Phishing. All it takes is a quick look at LinkedIn or other social media to find out about the CEO, the Bookkeeper or any other role that has the potential to move money. Once they have identified those individuals, they will begin their campaign of Spear Phishing emails and telephone calls. They will repeatedly target those individuals and as they gather more intel, they get better at specifically targeting you. Their aim is to have you reveal enough information that they can then manipulate you into interacting with them or simply click on an email that has malware imbedded in it.  Once the malware has executed it can gather information such as passwords, personal information, or even full access to your email.  

Second: This method is common and unfortunately often overlooked. It is hard to manage unique passwords for everything, the pitfall then resulting in people reusing passwords for multiple systems and websites. How often are your employee network passwords the same ones they use online for personal email or online shopping? We read regularly of hacked online credentials for anything from Facebook to Marriot Hotel. If I am a hacker and I can do a quick search on the Dark Web for credentials used by Byron Martin... It just costs me a few bucks to purchase those credentials which I can then to log into Byron's company email or company computer systems. No Hacking Required!