W H I T E PA P E R

How to Stop Business
Email Compromise Threats
Advanced techniques for fighting
financial phishing fraud©2022 Cloudflare Area 1 Security | www.cloudflare.com

H OW TO S TO P B E C

Overview
Exploiting an existing relationship between a victim
and organization, Business Email Compromise (BEC)
attacks are a specific form of financially motivatedphishing attacks. In our third annual update on thestate and evolution of BECs, we find that BECs haveremained the most costly cyber attack, resulting inmillions in damages, and surpassing reported costs
from ransomware attacks.
By now, BEC has become a fairly well-recognized term inmany industries so we will omit a detailed breakdown of
BEC types in this report. (For those who are interested,we’ve previously broken down the various BEC types inour previous ebook, “BEC in 2021: Supply Chain-Based
Phishing Attacks on the Rise.”) Law enforcement has
also made progress in bringing BEC actors to justice.
Recently, several perpetrators of international BEC rings
have been apprehended, including participants in a $10
million laundering operation and SilverTerrier, a large
Nigerian cybercrime gang that’s amassed over 800,000
stolen passwords from 50,000 targets.

©2022 Cloudflare Area 1 Security | www.cloudflare.com

Yet despite the many years they have been in the
public purview, these phishing attacks, ranging fromthe absurdly simplistic to well-researched “longcons,” BECs continue to evade security systems andreach victims.
Why? Much of this is due to the still constantly evolving
nature of BECs and threat actor techniques. We’ve
previously reported on attackers abusing COVID-19
vaccine availability and other timely events as lures. The
relative ease, low cost to execute and profitability is also
attractive for cyber gangs, including nation-state hacking
groups looking to “broaden their horizons.”
For more about the current state of BEC attacks and how
to effectively stop them, read on.

2

H OW TO S TO P B E C

BEC – just as (if not more) impactful as ransomware
While staggering ransomware demands tend to hog theheadlines, BEC is one of the most financially damaging
cybercrimes according to the FBI, resulting in more than
$2 billion in reported losses.
Yet organizations tend to underestimate the severity of
BEC attacks. This is due in part to most companies failingto report BEC incidents. Additionally, unlike ransomware,
where the attack is very obvious, some organizations
may not even know they were a victim of BEC fraud
until a later audit or third-party reporting. After all, BEC
money transfers are typically approved by a legitimate
employee!
Despite the under reporting, according to the 2021
Verizon Data Breach Investigations Report2, BEC attacks
compromised the second most common form of social
engineering attack, with 95% of financial losses falling
between $250 and $984,000 per incident.
Our own data from the 2021 Email Threat Report showedthat the average BEC request was $1.5 million. The
median was $260,000.

12While BECs make up just 1.3% of attacks, the fact thatthey are easily missed by many traditional security tools
can mean steep financial consequences. In 2021, Area 1
Security (acquired by Cloudflare) identified and stopped
nearly five million (4,987,526) BEC attacks — many ofwhich were missed by legacy secure email gateways andcloud email suites.

Average BEC request
intercepted by Area 1 =$1.5 Million

In 2021, Area 1 identified
and stopped nearly 5 million
BEC attacks

https://www.ic3.gov/Media/Y2020/PSA200406
https://www.verizon.com/business/resources/reports/dbir/2021/masters-guide/©2022 Cloudflare Area 1 Security | www.cloudflare.com

3

H OW TO S TO P B E C

BEC “Worst Hits”
Here are some of the most [in]famous BEC attacks hitting major brands and costing millions in damages.

VictimLossYearWhat happened

Facebookand Google$123 Million

2019

A Lithuanian scammer impersonated Quanta Computer, anelectronics supplier for Facebook and Google. Facebook and Google
paid $123 million in fake invoices to the scammer.

Crelan Bank

$75.8 Million

2016

Belgian-based Crelan Bank lost over €70 million (roughly $75.8million) to fraudsters who compromised the CEO’s email account.
The attack was later discovered in an internal audit.

ToyotaSubsidiary$37 Million

2019

A European subsidiary of the Toyota Boshoku Corporation(subsidiary of the Toyota Group) was duped into transferring ¥4billion (approximately $37 million) in a BEC scam.

Scoular$17.2 Million

2014

US commodities trading company Scoular wired $17.2 million to a
fraudulent offshore account after receiving a fake email from the CEO.

Mattel$3 Million(recovered)2016

A financial executive at Mattel transferred $3 million to a fraudulent
account after receiving a spoofed email appearing to be from the CEO.

Why are BEC attacks stillso successful?
BEC attacks can be notoriously difficult to
detect and therefore stop. These attacks rely on
authenticity and a deep understanding of thetarget’s behaviors and business processes. Thatknowledge extends to compromising the target’s
supply chain and partners as well. Other email
security solutions, including cloud email providers
and secure email gateways, are unable to accurately
identify these emails as malicious messages (moreon how attackers “Phish with the Cloud” here).

©2022 Cloudflare Area 1 Security | www.cloudflare.com

4

H OW TO S TO P B E C

The top four reasons victims fall for BECs

01

02
BEC uses social engineering
instead of malware.

Attackers use legitimate domains.
With cloud-based email providers, it’seasy and inexpensive for anyone to get alegitimate email domain. Attackers regularly
take advantage of a free or low-cost Gmail
domain, for example, to send phishing emails.
It’s also trivial for an attacker to purchase alegitimate “lookalike” domain similar to theirtarget victim’s domain.

Instead of including malicious links or
weaponized attachments, BECs are usuallyshort, text-only messages. They rely on
our tendency to follow social etiquette, likelending a hand to a coworker, or powerdynamics, like complying with an urgent
request from an executive, to trick victims
into sending money to fraudulent accounts.

By using legitimate and/or newly createddomains, phishing emails can pass email
authentication checks. Solutions that rely
on domain reputation alone to determine
maliciousness can also miss these BECs.

Traditional email security tools that rely on
scanning a malicious link or attachment for
known signatures will miss BECs.

04

03
BECs are low volume but
highly targeted.

Victims are usually unaware of accounttakeovers or compromised credentials

Our 2021 Email Threat Report showed thatBECs made up only 1.3% of attacks andan even smaller percentage of total emailvolume. However, BECs are extremely
targeted —attackers will research targets
and intended recipients to craft messages
that appear personal and legitimate.

Type 4 (as defined by Gartner’s “Protecting
Against Business Email Compromise Phishing”
report), the most sophisticated BEC, often
leverages account takeovers, where an attacker
has hijacked a legitimate user’s account. Theattacker silently observes ongoing email threads(sometimes for several months), before insertingthemselves in the conversation at the critical
moment to divert a payment.

Security tools that rely on baselining what
“normal” benign messages look like, or
require a higher volume of threats to createa signature, fail to detect BECs accurately.

©2022 Cloudflare Area 1 Security | www.cloudflare.com

Only advanced detection techniques
using contextual analysis can catch these
sophisticated compromised vendor attacks.

5

H OW TO S TO P B E C

Top BEC targets
Here are the top industry sectors Area 1saw being targeted for BEC attacks in 2021.

Repair & Maintenance Services | 87.65%
Non-Government Services |3.8%

Soap & Cleaning Compound Manufacturing |2.09%

Other General Manufacturing |1.74%

Retail Trade |1.31%

All Other Industries

What does a sophisticatedtype 4 BEC look like?
1Attacker hijacks thread andpivots to attacker account2

Legitimate, benign
email thread$4+ million BEC fraud attemptThis attack uses a partner account-takeover tohijack a legitimate, benign conversation thread
before pivoting the conversation to the attacker’saccount.
The attacker compromises a partner’s account(“Jeffrey”), then hijacks the thread. Sending froma malicious look-alike domain, the attacker pivots
the thread to the attacker’s account. The look-alikesender domain is identical to the benign sender
domain but ends in .co instead of .com.
This attack checks all four of the “BEC successfactors” discussed previously.

©2022 Cloudflare Area 1 Security | www.cloudflare.com

6

H OW TO S TO P B E C

Four techniques to stop BEC attacks
While some BECs can be spotted by careful recipients, most sophisticated BEC
attacks – the ones that can result in substantial financial loss – typically require trained
professionals and advanced phishing detection solutions. Small variations in details
matter, especially in BECs that involve partner account takeovers as the attacker has thecorrect “login” and privileges already.

01

02

03

04

Sentiment
analysis

Active fraudverdict escalations

Conversation andthread analysis

Sender trust graphs

Looking at message
content isn’t
enough. Accurate
BEC detection
requires looking
into the intent of themessage. Message
tone, relationship(s)between the senderand recipient(s) andany relationshiphierarchy also needs
to be considered.

In sophisticated Type
4 BECs, most of themessages withina conversation arebenign. The onlyattacker briefly inserts
themselves into
the thread to divert
payment. An effective
BEC detection solution
must include a way toescalate and notify ofpotential fraudulent
communications
happening in realtime. Automatically
blocking/quarantining/
retracting malicious
messages and kicking
off a review process
can prevent funds frombeing transferred.

Similar to sentiment
analysis, conversationand thread analysis
looks at intent andrelationships within
entire conversation
threads. Nuancessuch as variation inmessage(s) withina thread and lengthof messages canindicate a sender is
not who they appear
to be, indicating
account takeovers
and cases where aconversation has
been hijacked by anattacker.

©2022 Cloudflare Area 1 Security | www.cloudflare.com

Social graphs areimportant in detecting
BEC, especially
supply chain based
attacks, as it canbe used to map risk
exposure and trust
relationships. Thisis key in discovering
account takeovers
and partner
impersonations
where the sender isa “trusted” individual
outside of yourown organization.
Advanced BEC
detection techniques
also analyze partner
social graphs andsending history.

7

H OW TO S TO P B E C

Never trust
Email is an open gate that compromises
even the most ironclad Zero Trust networkarchitectures. Area 1 doesn’t trust emails just because
they have email authentication set up, are from
reputable domains, or have a prior communication
history with the potential target. In fact, BECs are much
more likely to originate from senders and infrastructurethat are “trusted” by deterministic security controls.

Extending Zero Trustprinciples to email
As organizations look to adopt new security principles
and network architectures like Zero Trust, email is a
critical gap. In this ebook, we have seen how attackers
steal money and data by “just asking” at the opportune
time. BEC attacks don’t need sophisticated malware or
network intrusion to succeed – they exploit our implicit
trust in email communications.
With Area 1 as part of Cloudflare Zero Trust, customers
will get comprehensive Zero Trust that’s inclusive of themost used and most attacked SaaS application today –email.

Here is how Area 1 helps extend Zero Trustprinciples to email:
Assume breachArea 1 correctly assumes that phishingcampaigns are always being set up. With
massive-scale phish indexing, Area 1 scans the Internet
to hunt for attacker infrastructure and proactively block
phishing attacks days before they hit the inbox.

©2022 Cloudflare Area 1 Security | www.cloudflare.com

Always verify
A fundamental tenet of Zero Trust is tocontinually verify every user and request,
even if they are inside the corporate network. Area 1
enacts multiple protection layers before, during, andafter emails reach the inbox. All types of communication(external, internal, from trusted partners) are analyzed
with similar diligence. Users are protected fromdeferred attack campaigns – where benign links arepivoted to attacker-controlled infrastructure after theyreach the inbox – by Area 1’s integration with Cloudflare
Remote Browser Isolation.

Understand (and share) email
threat context
Email is different from every other SaaS
application because of the vast array of “fuzzy”
signals it generates, including email content, tone andsentiment, unexpected variations in email threads,
and sender-recipient relationships. Area 1 uses
sophisticated contextual analysis to parse and weigh
all these signals to identify highly targeted attacks inprogress – protecting users on the most used (and mostdifferent) SaaS application.
Moreover, cross-sharing of threat intelligencegenerated by Area 1 with the 1T+ daily DNS requests
observed on the Cloudflare network will better protect
customers from all Internet threats.

8H OW TO S TO P B E CWhat’s next?
Business Email Compromise can cost a single organization millions in
direct losses. Difficult for traditional email security tools to identify, BEC
is most effectively stopped by email security solutions using advanced
detection techniques.
Area 1 has always been focused on stopping phishing attacks – the single
largest cyber threat vector – including BEC attacks. Our cloud-native
email security platform uses sophisticated contextual analysis to detect
all types of BEC attacks before they cause damage.

Advanced techniques to detect and stop BECs
We use various proprietary technologies to detect a comprehensive range of advanced attacks,including BECs. Our cloud-scale solution integrates with and supports organizations of all sizes.

To see how we detect and stop sophisticated
BEC attacks, please request a demo.

©2022 Cloudflare Area 1 Security | www.cloudflare.com

9© 2022 Cloudflare Inc. All rights reserved. The Cloudflare logo is a trademarkof Cloudflare. All other company and product names may be trademarks of
the respective companies with which they are associated.

©2022 Cloudflare Area 1 Security | www.cloudflare.com