## 3 Literary Review  
Business Email Compromise (BEC), as a man-in-the-middle email attack, is a type of cybercrime where a scammer uses sophisticated crafted emails or computer intrusion techniques in order to trick someone into conducting unauthorized transfers of funds or divulging confidential company information. The attacker usually starts by researching the profile of the employees, gathering information from online data and social media, and monitoring ongoing conversations in the victim's organization. This information is crucial in order for a highly convincing email to be crafted. BEC mails are targeted, and the body text is usually crafted in a familiar language context for the victim. Also, BEC mails are sent from compromised accounts, spoofed addresses or seemingly legitimate domains and so they cannot be detected from spam filters. BEC attacks usually come in the form of:  
* Spear Phishing attack: in which a hacker targets a specific individual or organization, undergoing a thorough research of the target's information to increase the chances of the scam attempt being successful. * Whaling attack: a type of spear phishing attack, but in this case, the target is usually a high-profile executive such as a CEO or CFO [6]. According to the FBI's 2022 report [7] BEC is one of the fastest growing, most financially damaging internet-enabled crimes, and is a major threat to the global economy. The sophistication of BEC criminal actors and their ever-evolving tactics has increased over time, likely driving increased dollar losses. BEC actors have targeted large and small companies in every U.S. state and more than 150 countries around the world. As IC3 mentions [8] in its 2022 crime report, the agency reports 21,832 Business Email Compromise (BEC)/Email Account Compromise (EAC) victims, with adjusted losses at nearly USD 2.7 billion. Figure 3 shows a chart from IC3 with the numbers of victims for various crime types for 2022, Figure 4 shows an estimation of victim losses categorized by crime type for 2022, and Figure 5 shows Greece's place in a chart with the top 20 countries by number of total victims as compared to the United States for 2022. Figure 4: Estimation of victim loss categorized by crime type for 2022 [8]. Figure 3: Chart with number of victims for various crime types [8]. The European Union Agency for Cybersecurity (ENISA) also reports that BEC is one of the most impactful types of cybercrime. Compared to previous years, the median transaction size for Business Email Compromise attacks further increased substantially, despite the efforts of law enforcement agencies to suppress this tension [9]. Figure 6 shows a chart with a time series of major incidents observed by ENISA (July 2021-June 2022) concerning social engineering threats. Data Breach Investigation (DBIR) reports for 2022 say that only 41% of BECs involved phishing. Of the remaining 59%, 43% involved the use of stolen credentials against the victim organization. The percentage remaining were most likely BECs using an email from a partner. Figure 7 shows the median transaction size for BECs base on FBI IC3 complaints where a transaction occurred. It seems that scammers in 2022 increased their demands [10]. Figure 5: Chart of the top 20 countries by number of total victims as compared to the United States for 2022. The specific number of victims for each country are listed in ascending order to the right of the graph [8]. Figure 6: Time series of major incidents observed by ENISA (July 2021–June 2022) concerning social engineering threats [9]. According to the Cloudflare 2021 security report [11], BECs made up only 1.3% of attacks and an even smaller percentage of total email volume. However, because of the fact that a BEC attack is extremely targeted due to the extreme research of the target's profile, the financial cost of this type of attack is disproportionate to the above mentioned volume. Table 1 shows some of the costliest BEC attacks hitting major brands.