Business Email Compromise (BEC) — also known as “Email-Scam” or “CEO-Fraud” — poses a serious threat to businesses, companies and individuals on a global scale, and is one of the most prominent cyber threats today.
Criminals impersonate senior executives to request urgent payments.
Fake supplier emails divert legitimate payments to criminal accounts.
Hacked mailboxes are used to request payments from contacts.
BEC criminals research their targets, then use carefully crafted emails to trick staff into transferring money or revealing sensitive information.
An email appearing to come from a senior executive instructs staff to make an urgent, confidential payment — often while the executive is travelling or unavailable.
Criminals impersonate a regular supplier and advise that bank account details have changed, diverting legitimate invoice payments to accounts they control.
A genuine business email account is hacked and used to request payments or sensitive information from customers, suppliers and colleagues.
Train every member of staff who handles payments or sensitive information to stop and check when they see these red flags.
Awareness material illustrating how Business Email Compromise works and how to protect your organisation. Click any image to view it full size.
Most BEC losses are preventable with verification procedures, staff awareness and basic email security.
Always confirm payment requests and bank detail changes by calling the requester on a trusted, independently sourced number.
Require two people to approve payments and changes to supplier details, with no exceptions for urgent requests.
Run regular awareness training so everyone who handles payments can recognise and report BEC attempts.
Use strong, unique passwords and multi-factor authentication, and keep systems and software up to date.
Inspect sender addresses character by character — criminals register lookalike domains that differ by one letter.
Report attempted and successful BEC scams to the FIU, whether or not any money was lost.
Report it to the Cook Islands Financial Intelligence Unit immediately — whether or not money was lost. Early reporting helps recover funds and protect others.
