How Attackers Weigh the Pros and Cons of BEC Techniques

RSA CONFERENCE 2021 – Business email compromise (BEC) and phishing attacks make up a big chunk of security issues plaguing today's organizations, and they continue to prove a threat as attackers find new ways to blend into victims' inboxes and manipulate them into sending funds.

In its "2020 Internet Crime Report," the FBI Internet Crime Complaint Center (IC3) found Internet crime led to reported losses exceeding $4.2 billion. Of the 791,790 complaints received in 2020, 19,369 involved BEC and email account compromise (EAC) and caused $1.8 billion in losses.

"As the fraudsters have become more sophisticated, the BEC/EAC scheme has evolved in kind," officials wrote in their report. 

In 2013, attackers often began these campaigns by breaching the email accounts of chief executive officers or chief financial officers and sending emails to request wire payments that were sent to fraudulent locations. Now BEC/EAC attackers breach personal email accounts, compromise vendor emails, request W-2 forms, and ask for gift cards.

The wire transfer is "an evolving staple" of BEC, said Crane Hassold, senior director of threat research at Agari, in a talk at this week's virtual RSA Conference discussing the various forms that BEC can take. Social engineering is "extremely effective," BEC often has a higher return-on-investment compared to other attacks, and most defenses focus on the more technical attacks.

Wire transfers have some notable pros for attackers: They can lead to much higher payouts, for one, and they lend themselves to more sophisticated pretexts designed to trick their victims.

As an example, Hassold described one BEC attack that appeared toward the end of 2020 in which the attacker used a capital call as pretext for requesting $42,080 from a target business. A capital call is a request made by a firm to receive money promised to it by an investor.

"We've seen these types of payments go upward of $1 million," Hassold said, noting that investment-themed BEC attacks can usually demand higher amounts without seeming unusual.

In another recent BEC attack, the attacker impersonated a CEO during an acquisition. They emailed a member of the finance team to contact another attacker impersonating a legitimate attorney. Following this "handoff," the target employee was asked to make sizable payments as part of the acquisition, which was ultimately intended to go to the attackers.

"These are the types of sophisticated pretexts we see becoming more and more prevalent in the wire transfer/BEC space," Hassold said. 

Scammers spend more of their time creating emails that look legitimate. In doing so, they have credibility to demand more money in wire transfers.

While the wire transfer technique has its benefits, it also comes with downsides. These attacks often have slower payouts and require transfers between money mules before funds get to the attackers. Most scammers don't receive the money directly, Hassold noted, so they need intermediaries in the same location as their targets.

Counting BEC Cashout Methods
Payroll diversion is another BEC technique undergoing evolution as attackers seek new ways to be effective. These attacks involve an email to human resources requesting an update to an employee's bank account used for direct deposit.

Here, an upside to attackers is delayed detection. Employees only get paid once every couple of weeks; if their direct deposit doesn't come in, it'll take some time before they realize something is wrong. Another benefit is the type of mule accounts they can use. Most accounts used in wire transfers are normal commercial checking accounts. In payroll diversion, researchers see more prepaid accounts being used to receive funds, which enables a faster laundering process.

These prepaid cards are a key factor driving BEC today, said Hassold, noting that apps like CashApp are also becoming integral to the BEC ecosystem because they are a primary way funds are moved out of the country.

"CashApp lets someone convert funds to cryptocurrency very quickly," he noted.

There are also downsides to this technique. Employee salaries are unknown to attackers, so they don't know the payout unless an attack is complete. They also have a more limited range of targets because they can only email someone on the company's HR team.

Payroll diversion has, in many cases, eclipsed wire transfer as a percentage of BEC attacks, Hassold said, but it has fluctuated as companies implement protections. This tactic declined in early 2020 due to a change in mule accounts attackers were using. A primary organization used to receive payroll diversion attacks through 2019 put mitigations in place that forced attackers to seek new ways to receive their funds.

The third most popular tactic for BEC is the gift card scam. More than half (57%) of all BEC attacks Agari saw in 2020 requested gift cards as a form of payment, he noted.

Unlike payroll diversion, gift card scams have a much larger pool of potential targets. 

"There's a much larger population of potential employees that can be targeted in these attacks compared to other kinds of BEC attacks," Hassold said of gift card scams. 

Another pro for attackers is they are nonreversible. Once they are received, they are quickly laundered.

But unlike wire transfers or payroll diversion, the payout is smaller. A successful gift card scam will net the attacker $1,000 to $1,500, Hassold said. They're also less convincing to employees, who may be unlikely to purchase gift cards, snap pictures, and send them to attackers. 

"It has the potential to raise a lot of red flags as you go along," Hassold noted.

What's Next for BEC?
Scammers continue to think ahead and develop stealthier forms of attack, Hassold said.

He pointed to vendor email compromise as an example. In these attacks, the criminal sends a phishing email with the goal of capturing a victim's credentials in a phishing website. With the credentials, they can log into a target inbox and forward themselves information about invoices, payments, and other financial details. With this, the attacker is equipped to send a fake invoice to the company, posing as a customer and requesting money they expect to pay.

"A lot of BEC attacks we see in the news today are going to be these vendor email compromise attacks," Hassold said.

Another upcoming tactic involves the aging report, or a financial report that lists outstanding payments due for a vendor or supplier. It contains data on payments overdue, points of contact for each customer, and other information. Some BEC attackers now request an aging report instead of a wire transfer because they can use it to send convincing payment requests.

"What the attackers will do is they'll use all this information to send an email to all the customers on this list to send payments for outstanding balances," Hassold explained. 

In January 2021, more than 10% of all BEC attacks were requesting an aging report, "so we can see this is becoming much more popular in the BEC sphere."