Home » Email Security » Almost $2 billion lost to Business Email Compromise (BEC) scams in 2020
BEC Attacks

Almost $2 billion lost to Business Email Compromise (BEC) scams in 2020

Almost $2 billion lost to Business Email Compromise (BEC) scams in 2020

Almost $2 billion lost to Business Email Compromise (BEC) scams in 2020

Losses emanating from Business Email Compromise (BEC) and Email Account Compromise (EAC) scams surpassed US$1.86 billion last year, which is more than the combined losses stemming from the next six costliest types of cybercrime listed in the 2020 Internet Crime Report by the Federal Bureau of Investigation (FBI).

The Bureau’s Internet Crime Complaint Center (IC3) received more than 19,000 reports of BEC/EAC scams last year, a decrease compared to the almost 24,000 incidents reported in 2019. The associated losses, however, increased by over US$90 million and accounted for 45 percent of the total losses (US$4.2 billion).

To illustrate the magnitude of the problem that BEC/EAC scams present, consider that the second costliest cybercrime on the IC3’s list, confidence/romance fraud, registered losses of over US$600 million.

Meanwhile, losses reported from investment fraud were “only” some US$336 million. It bears mentioning that the number of victims more than doubled year-on-year, growing from almost 4,000 to almost 8,800. It’s also generally understood that many types of online crimes and fraud go unreported, so both the number of incidents and the resulting actual losses are very likely to be considerably higher.

Business Email Compromise

Business Email Compromise

Cybercrimes responsible for the greatest financial loss

One of the key reasons BEC scams remain such a problem is that they are constantly evolving and have become more sophisticated over time, said the FBI. In the past cybercriminals would either hack or spoof the email accounts of chief executives and then use them to request wire transfers to fraudulent bank accounts.

“Over the years, the scam evolved to include compromise of personal emails, compromise of vendor emails, spoofed lawyer email accounts, requests for W-2 information, the targeting of the real estate sector, and fraudulent requests for large amounts of gift cards,” said the Bureau.

BEC targeting various US government organizations

Just days ago, the FBI also issued an advisory about cybercriminals using BEC to target U.S. state, local, tribal and territorial (SLTT) government entities. Over the course of two years, the Bureau observed losses ranging from US$10,000 up to US$4 million, which crippled the operations of SLTT governments and left them strapped for resources. The onset of the COVID-19 pandemic exacerbated problems even further after employees were forced to rapidly transition to remote work.

The cybercriminals used spoofed emails, phishing attacks, vendor email compromise, and various credential harvesting techniques to modify the payment instruction for services rendered by vendors or to alter payroll direct deposit information.

“The substantial amount of publicly available SLTT government operating information required by government transparency requirements enables cyber criminals to acquire information on SLTT leadership, vendor relationships, and associated contractors, allowing them to tailor attacks directly to victims,” the Bureau warned.

In its advisory, the FBI also described several cases where scammers were able to successfully defraud government agencies. In one case, US$1.6 million were lost after a government official received an email with new instructions that came from a legitimate vendor email address. In another case, a small city government received a spoofed email alleging to be from a known contractor requesting a change in payment method, which eventually cost the city US$3 million.

The federal law enforcement agency also shared some advice on how to mitigate the risks of falling for BEC scams:

  • Be wary of last-minute changes in payment instructions or a change in the recipient’s account information
  • Be suspicious of unexplained urgency concerning payment requests
  • If any payment or transaction changes are announced, verify them either in person or using a known telephone number
  • Contact vendors through numbers that you have on file instead of those sent in emails
  • Be on the lookout for grammar and spelling mistakes
  • Double-check email addresses and look out for even the slightest changes that could make fraudulent emails look like the real deal

About emailfirmadmin

Businesses Email, Company Email, Email Service Providers in Delhi NCR India

Businesses Email, Company Email, Email Services Providers in Delhi NCR India, Google Gmail for secure, private, ad-free, cloud-based corporate Enterprise Email for Business on your company domain name. Includes 24x7 support Professional Business Email For Your Company That Matches Your Domain Name. Business Email G Suite on Google, Office 365 & Exchange Email on Microsoft Outlook. Email, Businesses Email, Company Email, Professional Business Email id from Microsoft, Google, Yahoo. Buy Best Secure Business Email Hosting Online with Succour. Best Email Service Provider in New Delhi - India's capital territory, Mumbai - formerly Bombay, Kolkata - formerly Calcutta, Chennai - formerly Madras, Bangaluru - formerly Bangalore, Bhubaneswar, Ahmedabad, Hyderabad, Pune, Surat, Jaipur, Email services in the following cities: Gurgaon , Delhi, Noida, Ghaziabad, Faridabad , Chandigarh, Navi Mumbai, Pune, Ahmedabad, Surat, Kanpur, Patna, Indore & in India

Sales Number : +91 9582 90 7788 | Support Number : +91-9654 01 6484
Sales Email : sales@itmonteur.net | Support Email : support@itmonteur.net

Register & Request Quote | Submit Support Ticket


Check Also

What is Anti-spam?

What is Anti-spam? Spam, What is spam? SPAM is irrelevant or unsolicited messages sent over ...