Business email compromise: five checks to make this week
Business email compromise tricks staff into paying fake invoices or new bank details. Five plain-English checks for a small business, with the ACSC guidance behind each one.
Published by oowl. General information for Australian small businesses, not advice for any particular organisation.
What it looks like
Business email compromise (BEC) is fraud that uses email to get money or goods out of a business by abusing trust in how it pays its bills. The Australian Cyber Security Centre (ACSC) covers it in its publication Protecting Against Business Email Compromise. Usually there is no malware. The criminal either gets into a real mailbox, or writes from a lookalike address and waits for someone to pay an invoice or change a bank account.
Two patterns are common. In the first, someone logs into a staff member's mailbox and sends genuine-looking invoices, or quietly reads the threads about upcoming payments. In the second, a message arrives from a supplier, a director or the owner saying the bank details have changed, and asking for the next payment to go to the new account before the end of the week.
Five checks to make this week
- Turn on multi-factor authentication for every mailbox. Start with the owner, anyone in finance and anyone who can approve a payment. A password alone is what the criminal is after. The ACSC's email security emergency response guide names MFA as one of the most effective steps against criminals getting into an account. Do not assume it is on: ask your IT provider to show you the setting for each account.
- Look for forwarding and inbox rules. Criminals often add a rule that copies or forwards mail to an outside address, so they see every invoice without needing to log in again. The same ACSC guide warns that intruders set up forwarding rules and advises deleting any you do not recognise. Ask for a list of rules and external forwarding addresses on each mailbox.
- Sign out other sessions and check sign-ins. Ending active sessions cuts off access an intruder already has. Then review the sign-in history for places and devices you do not recognise. Do this as soon as you suspect a mailbox has been taken over, not after the weekend.
- Check every change to payment details by phone. A new bank account or a changed invoice is where the money usually goes. Ring the supplier or the staff member on a number you already hold, never one in the email. Require a second person to approve any new payee or bank change, including when the request appears to come from the boss.
- Know where to report. Report incidents at cyber.gov.au/report, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). If money has already left your account, call your bank straight away as well, because they may be able to stop or recall a payment.
If you think it has already happened
Work through the steps in order and write down the time of each one. Change the password and the account recovery details, sign out of all sessions and turn on MFA, remove any forwarding rule you do not recognise, tell your bank if a payment went out, and report it. The ACSC's recovery guidance sets out the same steps in more detail. Keep the suspicious messages, because your IT provider and any investigator will want them.
Privacy obligations
A compromised mailbox often holds customer or staff personal information. If that information is likely to be accessed or disclosed and is likely to cause serious harm, the Notifiable Data Breaches scheme under the Privacy Act may require you to notify the Office of the Australian Information Commissioner (OAIC) and the people affected. The OAIC explains the test and the steps on its Notifiable Data Breaches page. Our Privacy Act and data breaches page describes how we help businesses prepare for this. It is general information, not legal advice.
What to do next
Book an hour this week with whoever looks after your email, and go through the five checks one at a time. Ask for the answers in writing, including which accounts have MFA, which have forwarding rules and who approves payment changes. Our Essential Eight page explains how MFA and patching fit into a wider plan for a business that has no security team. To see whether someone could send email that looks like it came from your domain, run our free email spoofing check.
Sources
- Protecting Against Business Email Compromise, Australian Cyber Security Centre
- Email security emergency response guide, Australian Cyber Security Centre
- Recover from business email compromise, Australian Cyber Security Centre
- Report a cyber incident, Australian Cyber Security Centre
- Notifiable Data Breaches, Office of the Australian Information Commissioner
oowl writes each post in its own words from the public sources listed. Guidance is updated over time, so check the sources for the latest detail. More posts: the blog, or our threat briefs.
Not sure where your business stands?
The free security check is a passive look at what your business already exposes to the internet, read from public records only, with a one-page result in plain English.