## 3 Literary Review
BEC attacks can be categorized in three major techniques according to [PERSON] et al. [13]:  
* Phishing-related techniques: A typical phishing attack involves the use of email containing a malicious URL link, PDF attachments containing malicious code or pointing to URLs, HTML files, and file-hosting service sites. * Malware-related technique: The use of malware for BEC attacks such as keyloggers and remote access tools (RATs) have proven extremely useful due to their effectiveness and low cost. This kind of malware is commonly available in hacking forums or \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Victim** & _Loss_ & **Year** & **What Happened** \\ \hline Facebook and Google & \$123 Million & 2019 & \begin{tabular}{c} A Lithuanian summer _impersonated_ Quanta Computer, an electronics supplier for Facebook and Google. Facebook and Google paid \$123 million in fake invoices to the scammer. \\ \end{tabular} \\ \hline Crelan Bank & \$75.8 Million & 2016 & \begin{tabular}{c} Belgian-based Crelan Bank lost over \$70 million (roughly \$75.8 million) to fraudsters who compromised the CEO’s email account. The _attack_ was later discovered in an internal audit. \\ \end{tabular} \\ \hline Toyota Subsidiary & \$37 Million & 2019 & \begin{tabular}{c} A European subsidiary of the Toyota Boshoku Corporation(subsidiary of the Toyota Group) was _duped_ into transferring approximately \$37 billion in a BEC scam \\ \end{tabular} \\ \hline Scoular & \$17.2 Million & 2014 & \begin{tabular}{c} US commodities trading company Scolar _wired_ \\ \$17.2 million to a fraudulent offshore account after receiving a fake email from the CEO. \\ \end{tabular} \\ \hline Mattel & \
\begin{tabular}{c} \$ 3 Million \\ _(recovered)_ \\ \end{tabular} & 2016 &
\begin{tabular}{c} A financial executive at Mattel _transferred_\$3 million to a fraudulent account after receiving a spoofed email appearing to be from the CEO. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Some of the costliest BEC attacks on major brands according to Cloudflare 2022 Security Report [12]. Figure 7: Transaction size for BECs base on FBI IC3 complaints where a transaction occurred [10]. in the dark web and has evolved to use crypto services to evade detection from antivirus programs. * Social engineering-based technique: This is the most common technique, where a well-crafted email is sent from the attacker who, through extensive research, is impersonating a entity known to the victim, usually a friend, associate, client, etc. These are the common characteristics of emails used in a BEC attack: 1. Subject: Email subjects that contain the words \"request\", \"payment\", \"urgent\" and \"wire transfer\" are a red flag for a BEC attack. 2. Reply-To: Due to the fact that most email clients do not display the reply-to addresses, actors insert their email address on the reply-to portion of the mail. 3. From: A legitimate-looking email address is crafted to impersonate a person of trust. 4. Frequency: The attack is more likely to succeed if BEC actors have checked the location and the time zone of the target. In the case of an attacker impersonating a CEO requesting a wire transfer, sending a BEC email during working hours on Friday and demanding that the request has to be resolved before the weekend has proven particularly successful. [PERSON] [14], on the other hand, reports three principal methods BEC scammers use to disguise themselves as a known entity to their victims:
* By gaining access to the victim's mail account, commonly referred to as Account Take-Over (ATO). Access is usually gained with phishing techniques or malware. * By spoofing a trusted party. Attackers usually spoof email addresses or reply-to addresses. DMARC has outdated this method, but not all organizations support it. * Through social engineering techniques and information from social networks like LinkedIn, a scammer can discover relationships between the victim and his/her associates and then register a deceptive domain name or email account.