Preventing BEC Fraud: How Can You Make Your Organization Resilient Against the Most Persuasive Cyberattacks?

Whereas traditional phishing attempts to deceive as many people as possible and extract information from them, BEC focuses specifically on certain individuals, processes, and moments. Cybercriminals seamlessly assume the identity of their victims and know exactly how they behave—all with the goal of getting them to make payments or make harmful changes somewhere.

In addition, cybercriminals use this method to understand how organizations operate—for example, the threshold amount above which management authorization is required. That’s why criminals often choose to funnel multiple smaller amounts—just below this authorization threshold—through employees to unknown bank accounts. They know that employees trust one another, that processes are sometimes carried out under time pressure, and that a credible request, written in the style of the real sender, often raises few questions.

“The average cost of a BEC attack? About €118,000 per incident. And more importantly, this type of fraud is usually not reimbursed because you made the payment yourself.” Source: National Cyber Security Center

This form of digital fraud goes far beyond a phishing email full of spelling mistakes, suspicious links, or implausible stories. BEC attacks are often carefully planned. Criminals gather information from websites, social media, and public documents. They map out organizational structures, identify decision-makers, and analyze communication patterns.

In many cases, they even gain access to an email account and read messages without being noticed before taking action. It is no longer enough to simply tell employees to pay close attention. Modern BEC attacks are often so convincing that fake messages are virtually indistinguishable from genuine communications.

What can you do to combat BEC fraud? Building resilience starts with the realization that the greatest vulnerability often lies not in technology, but in human behavior. When organizations consider cyber risks, their focus often turns to firewalls, antivirus software, endpoint protection, and other technical security measures. While these are indispensable, they are only part of the solution.

To make BEC fraud more difficult, you can take the following five people-centered measures, among others:

1. Apply the four-eyes principle and use clear verification procedures
If your organization is structured in such a way that a single person can independently make a large payment or change supplier information, you automatically face a greater risk. Therefore, always have important payments, changes to account numbers, or requests for sensitive information reviewed and approved by at least two people. In addition, always verify such requests through a second communication channel, such as by phone or text message.

Unfortunately, these days you can no longer rely solely on an email message. You can compare this to 2FA (two-factor authentication), which you also use to access systems and applications.

2. Train employees to recognize social manipulation
Anything involving pressure, secrecy, or authority should be considered suspicious: don’t trust it until proven otherwise. Have employees practice scenarios in which an urgent payment is requested or a new supplier asks to change bank account information.

3. Create a culture where verification is the norm
Employees must be able to verify a manager’s instructions or question a request without hesitation. Therefore, make it clear that it is better to verify once too often than once too little. Hierarchy must never be the reason why BEC fraud succeeds.

4. Limit and monitor financial authorizations
Grant employees only the authorizations they need to perform their jobs. In addition, regularly verify that authorizations, powers of attorney, and approval rights still align with their roles and responsibilities. The fewer people who can make critical changes or payments, the lower the risk of abuse or fraud.

5. Keep the topic of security up to date
Cyberattacks are constantly evolving and are becoming increasingly convincing thanks to AI. That’s why it’s important to stay up to date and regularly share relevant information. As an extra tip, you can find several practical tips on this page from the National Cyber Security Center to prevent BEC fraud. Download and share it, and also offer awareness training.

We help clients with everything from technical implementation to behavioral change. This is important because it takes more than just anti-phishing training to prevent BEC.