The sports category has moved to a new website.

When should you ignore an instruction from your boss?

Person using laptop on table [Image: Mikhail Nilov]
  • BEC or CEO fraud is a type of scam in which cybercriminals gain access to – or convincingly replicate – the email address of a senior staff member.
  • BEC wire transfer fraud criminals take advantage of an expected financial transaction such as supplier payment, bank account information or an outgoing wire transfer.
  • Always verify any payment requests or change of banking details with the recipient out of band, for example via WhatsApp or a phone call.

As organisations around the world spend even more on cybersecurity tools, cybercriminals are increasingly using a simple, yet effective ways to access organisations’ data or money through business email compromise (BEC) or CEO fraud.

International security awareness organisation, KnowBe4, explains that BEC is a type of scam in which cybercriminals gain access to – or convincingly replicate – the email address of a senior staff member.

They then mail a relevant person within the organisation, instructing them to share information, or assist in making a payment.

Because they do not request the recipient to click on a link or open up an attachment, they seem quite innocuous at first and do not trigger any security scanners or warning signs.

ADVERTISEMENT

BEC wire transfer fraud sees criminals taking advantage of an expected financial transaction such as a supplier payment, and asking the recipient to adjust the bank account information on an outgoing wire transfer.

In many cases, the instruction may appear to come from the victim’s boss, and may even be written in a similar style that is used by the boss.

Another common type of BEC is gift card scams, in which attackers pretend to be a colleague of the victim and ask them to purchase a digital gift card.

ADVERTISEMENT

Anna Collard from KnowBe4 Africa, says: “35% of all security incidents are business email compromise phishing attacks. According to security vendor GreatHorn’s 2021 Business Email Compromise Report, 71% of BEC attacks use a spoofed email account or website to establish credibility. Sixty-nine percent of BEC attacks utilise spear phishing, increasing their chances of reaching the right people within an organisation who have influence over money. According to the report, the finance industry is targeted 57% of the time, with CEOs next (22%) and IT third (20%).

“Reducing the risk of such attacks starts with security awareness training. People are sometimes not aware of the value of their email accounts. Beware of falling for phishing emails and ensure that you use strong and unique passwords on all your email accounts. Add another layer such as two-step or multi-factor authentication to your password,” Collard says.

Additionally, verify any payment requests or change of banking details with the recipient out of band, for example via WhatsApp or on a phone call.

JOIN OUR PULSE COMMUNITY!

ADVERTISEMENT

Eyewitness? Submit your stories now via social or:

Email: news@pulselive.co.ke

ADVERTISEMENT