Help Prevent Business Email Compromise Attacks in Retail

Business email compromise (BEC) attacks, which involve the unauthorized use of business email accounts to manipulate or steal sensitive information, are increasingly affecting the retail sector.

Grappling with these sophisticated scams can feel like an exercise in futility, but there are ways to make your people and processes more resilient against this type of cybercrime.

What is business email compromise?

BEC attacks typically involve cybercriminals gaining access to or spoofing legitimate business email accounts. They use social engineering tactics to trick your employees, vendors, or customers into:

• Divulging confidential information,
• Transferring funds, or
• Altering payment details.

Unlike traditional phishing attacks, BEC schemes rely on carefully crafted messages appearing authentic and urgent, making them particularly effective. BEC attacks are a common cyber insurance policy claim.

Common types of BEC attacks

BEC attacks can take various forms, each with its own set of tactics and objectives. Some of the most common types include:

• CEO fraud: Cybercriminals pose as senior executives and instruct employees to transfer money or share sensitive information.
• Vendor email compromise: Attackers impersonate vendors or suppliers and request payments to fraudulent accounts.
• Account takeover: Hackers gain control of legitimate email accounts and use them to conduct unauthorized transactions. These are especially difficult to detect since the fraudster is using legitimate emails from a trusted party to facilitate the fraud.
• Invoice scams: Fraudsters send fake invoices to businesses, demanding payment for non-existent goods or services.

The impact of email threats on the retail sector

The retail sector, characterized by its extensive networks of suppliers, vendors, and customers, has become a prime target for BEC attacks — often with far-reaching consequences.

Financial losses

BEC attacks can result in significant financial losses for your retail business. Cybercriminals often target high-value transactions and exploit the urgency of business operations to initiate fraudulent transfers. The monetary impact can be devastating, with some companies losing millions of dollars in a single attack.

Reputational damage

The integrity of your retail business is paramount, and a successful BEC attack can severely tarnish its reputation. Customers and partners may lose trust in your ability to safeguard sensitive information, leading to a decline in business relationships and consumer confidence.

Operational disruptions

BEC attacks can disrupt the normal functioning of your retail operations. When funds are diverted or payment details altered, supply chains may be affected, resulting in delayed or canceled orders. The ensuing confusion can hinder day-to-day activities and strain business resources.

Litigation

The aftermath of BEC attacks can create hostility and strained relationships between affected parties. Confusion and blame can lead to legal disputes as businesses and vendors struggle to determine accountability for the fraudulent transactions and establish who is responsible for reimbursing the lost funds.

Cybersecurity strategies for retail businesses

To help combat the rise of BEC attacks and email threats, retail businesses can adopt comprehensive cybersecurity strategies. Key measures include:

Employee training

Educating employees about the risks and signs of BEC attacks is crucial. Regular training sessions can enhance their ability to identify and respond to suspicious emails. Training should be focused on departments handling financial transactions (AR, AP, payroll, etc.)

Formal policies and procedures

Document formal processes around critical activities, such as updating payment information, adding or changing vendor records, etc. Train employees on these processes.

Email authentication protocols

Implementing authentication technologies can help verify the legitimacy of incoming emails and prevent spoofing. Cloud email services should be configured to support multi-factor authentication and insecure protocols should be disabled.

Multi-factor authentication (MFA)

Using MFA adds an extra layer of security to email accounts, making it more challenging for attackers to gain unauthorized access. Some forms of MFA have more security than others (e.g., number matching is more secure than push notifications).

Incident response plans

Developing and rehearsing incident response plans can help your retail business act swiftly and effectively in the event of a BEC attack. Make sure you can forensically review emails and logs to assess fraudulent activity.

Regular cybersecurity assessments

Conducting periodic cybersecurity assessments to evaluate your security posture, such as penetration testing, social engineering, vulnerability assessments, etc.