## 4 Methodology Strategies Preventing BEC Attacks
### Procedures after a BEC Attack  
The general steps from the attacker's point of view is to gain access to a victim's credentials, impersonate a trusted entity, send fraudulent email, and extract money or sensitive information, as shown in Figure 12.  
After a cyberattack in general, and in this case after a BEC attack, it is crucial for the victim to perform a number of procedures in order to inform and facilitate the relevant authorities (Figure 13). These procedures include [40]:  
* Contacting law enforcement (in the case of Greece, the Unit of Special Cases and Internet Economic Crimes Prosecution) and other competent authorities as soon as possible.  
Figure 12: General of a BEC attack from the attackers point of view.  
* Immediately informing the banking institute via phone and then through a Transaction Dispute Form.
* Providing the authorities dealing with the case with evidence like:
* Email addresses, email headers, and associated Internet Protocol (IP) addresses with their respective timestamps.
* A description and timing of suspicious email communications.
* Phone numbers.
* Wire transfer details:
* Dates and amounts of suspicious transactions.
* The sender's identifying information, account number and financial institution.
* The beneficiary's identifying information, account number and financial institution.
* The correspondent and intermediary financial institution's information, if applicable.  
From this point and onward, the Law Enforcement Agencies (LEAs) and the investigators will alert the Beneficiary Financial Institution and the Financial Intelligence Unit (FIU), and they will try to analyze the BEC attack by:  
* Obtaining a copy of the emails and performing the following steps:
* Initiating the investigation process by requesting information from the victim's email provider (if applicable). This entails:
* IMAP (Internet Message Access Protocol)--The emails must remain on the server. A copy of the emails should be obtained from the email provider via the legal process or from the victim's server.
* POP (Post Office Protocol)--Emails are downloaded from the email provider to the victim's computer. Emails are not located on an external server and must be obtained from the victim's computer.
* An investigation for spear phishing attacks from what appears to be legitimate vendors (slight changes in email address) and for additional communications with the misspelled domain.
* An investigation for indications of out-of-band communication changes (e.g., phone number).
* An investigation for possible email redirect rule.
* Running a PowerShell command across the network looking for forwarding rules because more than one computer may be affected.
* Forensic Analysis of the computer:
* Malware may have been used to harvest email credentials (allowing access to the email account). The use of malware may or may not be contemporaneous with the BEC. Often, access to the email account occurs weeks/months prior to the BEC.
* An analysis of the victim's computer/system, even though it does not generally lead to direct information of the transfer of funds (usually provides information on how the email credentials were compromised).  
The above procedure is common among the EU members. In later stages of the investigation and as mentioned before, especially if the attack or the wire transfers originated from foreign countries, a Joint Investigation Team can be formed. Knowing how to treat the evidence of a BEC scheme is crucial for the successful investigation of the crime. Companies, as mentioned previously in the section of non-technical methods of protection against BEC attacks, should have well trained and educated employees (preferably a blue team with forensic responsibilities) who can detect such attacks and gather as much evidence possible before LEAs take over the investigation [41].