If those numbers seem surreal, keep in mind, the threat is only growing. In 2020 alone, fraudsters scored nearly $2 billion dollars through BEC attacks. That’s considerably more in terms of raw dollar value than any other type of cybercrime.
The FBI calls business email compromise “the $26 billion dollar scam.” How is that possible? This article will take a close look at BEC scams to explain what they are, why they’re such an expensive problem, and also how you and your employees might be targeted.
Still having trouble grasping the gravity and scope of this threat? Here are five recent BEC scams and their estimated losses to convince you that no business is immune:
Facebook & Google
A man was arrested in 2017 for carrying out a two-pronged BEC attack targeting tech giants Facebook and Google. This lone actor managed to cause roughly $120 million dollars in losses between both companies.
The crime was carefully plotted over a two-year period between 2013 and 2015 by Evaldas Rimasauskas, who impersonated an individual at tech company Quanta Computer. Rimasauskas spoofed fake emails, attorney letters, invoices, and other official-looking materials to trick employees into false bank transfers.
Ubiquiti
Back in August 2015, IT giant Ubiquiti reported fraud to U.S. Securities and Exchange Commission to the tune of nearly $47 million dollars.
No one is totally sure exactly how the fraud was committed. However, it is likely a case of account takeover (or ATO) fraud facilitated through a BEC attack. The scam showed signs consistent with social engineering.
Toyota
Even automobile super-conglomerate Toyota is susceptible to BEC attacks. In 2019, Japan’s Toyota Boshuku Corporation lost about $37 million dollars to a BEC scam.
Toyota has not commented publicly on exactly how the hackers carried out the attack. That said, it’s likely that the scam involved internal emails sent from fraudsters posing as senior Toyota executives.
Scouler
In 2014, an employee of Scouler Corporation in Omaha, Nebraska answered an email from his boss, Chuck Elsea. The email explained that Elsea was keen to acquire a Chinese company and requested that the employee contact a lawyer to facilitate the funds transfer required to purchase the company. This email was, of course, part of a scam attack.
In the end, the company lost $17.2 million dollars in the scam.
Entrepreneur Scammer
Obinwannae Okeke, a lauded entrepreneur, was sentenced to 10 years in prison for his involvement in a BEC scam that cost victims an estimated $11 million dollars. Okeke used every trick in the business email compromise arsenal to defraud companies and individuals, such as phishing, social engineering, ATO fraud, false webpage creation, and domain engineering.
These are just a small fraction of the total BEC fraud that has swept the globe in the last decade. But, now that we know and understand the scale of the threat, what are you supposed to do if you believe a business email scam is in progress? We’ll dig into that in the next section.
