Stopping BEC Starts with User Protection

---

BEC is one of the most financially devastating cyberthreats organizations face today. Unlike generic phishing scams, BEC attacks are highly targeted and meticulously crafted. Cybercriminals impersonate executives, vendors or trusted partners to manipulate employees into transferring funds or revealing sensitive information. The financial impact is staggering — by early 2024, the average requested wire transfer in a BEC attack surged to $84,059, nearly 50% higher than the previous quarter, not including incident response costs. To mitigate risk and prevent BEC attacks, companies need to invest in robust security, and user protection is the cornerstone of that effort.

---

---

Why is BEC so hard to fight?

---

BEC isn’t an easy cyberattack to spot because bad actors are constantly evolving their techniques, tactics and procedures (TTPs). What makes BEC particularly dangerous is its reliance on social engineering tactics. These attacks often use email impersonation to trick employees into authorizing fraudulent wire transfers or sharing confidential data. The rise of artificial intelligence (AI) has made BEC even more dangerous and prevalent, enabling the creation of convincing deepfakes and undetectable phishing emails.

According to our Kaseya Cybersecurity Survey Report 2024, human actions are the top cybersecurity challenge for IT professionals. Nearly half of respondents identified poor user practices or gullibility as a major issue, marking a dramatic increase from 15% in 2023 to 45% in 2024. Organizations must adopt a proactive user protection approach that combines robust security controls with ongoing user education to reduce the risk of BEC trouble.

---

---

Users are the key to BEC

---

BEC attacks prey on human trust, making user protection essential to any cybersecurity strategy. While technology is crucial, employees are the first line of defense against these highly targeted scams. Unfortunately, cybercriminals use sophisticated tactics that prey on human psychology to make their emails highly convincing to users. Findings from CISA phishing testing reveal how effective high-quality email lures can be in deceiving users.

• One in eight organizations had at least one individual who fell victim to a phishing attempt by CISA Assessment teams.
• One in 10 phishing emails sent by CISA Assessors had a user execute a malicious attachment or interact with a malicious link.
• Within the first 10 minutes of receiving a “malicious” email, 84% of employees took the bait by either replying with sensitive information or interacting with a spoofed link or attachment.
• Just 13% of targeted employees reported the phishing attempts sent by CISA Assessors

As this data makes clear, user protection, including comprehensive cybersecurity awareness training, is a foundational element of any successful defensive strategy against BEC.

---

---

2 real-life examples of the devastating financial impact of BEC

---

These two real-life examples of BEC scams that resulted in major financial hits for businesses are excellent illustrations of just how insidious and damaging BEC can be.

Hong Kong: A deepfake scam leads to a $25 million loss in a video call fraud

A company in Hong Kong fell victim to a highly sophisticated BEC attack that used deepfake technology, resulting in a $25 million loss. The attack began with a phishing email impersonating the company’s U.K.-based CFO, instructing a finance employee to transfer funds to an offshore account. Initially suspicious, the employee hesitated until they were invited to a video call with what appeared to be the CFO and other company personnel. The convincing deepfake audio and video allayed the employee’s doubts, leading them to approve the transfer, only to later discover the entire interaction had been artificially generated by attackers.

Canada: NioCorp Developments loses $500,000 in a vendor payment scam

Canadian mineral exploration firm NioCorp Developments suffered a $500,000 loss due to a BEC attack that compromised its email systems. Unauthorized access allowed cybercriminals to redirect a vendor payment to a fraudulent bank account. NioCorp quickly detected the breach and reported it to federal law enforcement and financial institutions in the hope of recovering the funds. The company has since launched an investigation and containment measures, though the full financial impact remains uncertain.

---

---

5 Proactive ways to shield users from BEC threats

---

Protecting users from BEC threats can be a major challenge for any business. However, there are a few smart moves that IT professionals can make to limit user exposure to BEC threats.

1. Leverage an AI-powered email security solution

BEC attacks often bypass traditional spam filters, making advanced email security essential. AI-driven email threat detection tools can analyze email patterns, detect impersonation attempts and flag suspicious messages before they reach users’ inboxes, preventing fraudulent communications from taking root.

2. Empower employees with security awareness training

Employees must be trained to recognize and respond to phishing and social engineering tactics in BEC scams. Regular training, simulated phishing exercises, and updated threat briefings help keep users alert. Ensure all employees, especially managers who often make spending decisions, participate in ongoing training. A U.K. study found that managers are twice as likely as regular employees to fall for phishing.

---

---

3. Monitor and audit email traffic for anomalies

Continuous email monitoring can help detect signs of compromise, such as unusual login locations, unexpected email forwarding rules or changes in communication behavior. Automated security alerts can flag suspicious activity, allowing IT teams to investigate and mitigate potential threats before damage occurs.

4. Build a strong security culture

Everyone makes mistakes. Fostering a culture where employees feel safe reporting their cybersecurity errors is essential to a strong security strategy. However, about 50% of employees hesitate to report mistakes due to fear of severe consequences, such as termination.

5. Enforce strict verification procedures

Fraudulent wire transfer requests are a hallmark of BEC scams. Organizations should implement multi-step verification for financial transactions, requiring secondary approval through a phone call or secure communication channel. Similarly, any changes to vendor payment details should undergo rigorous authentication.

---

---

Stay ahead of BEC attacks with Kaseya 365 user

---

BEC attacks are constantly evolving, making it critical for businesses to implement a layered defense that combines user awareness, strong security controls and rigorous verification procedures. Employees remain the first line of defense, and when equipped with the right knowledge and tools, they can help prevent costly fraud before it happens.

With advanced threat detection, AI-powered phishing protection, security awareness training and streamlined user management, Kaseya 365 User empowers businesses to strengthen their cybersecurity posture and safeguard their financial and data assets.

Don’t leave your organization vulnerable. Take proactive steps to defend against BEC. Discover how Kaseya 365 User can enhance your security strategy today.

---

---