By Menghan Xiao

Business email compromise (BEC) attacks have increased by 81 per cent in 2022 and 175 per
cent over the past two years, while 98 per cent of employees failed to report the threat,
according to Abnormal Security.
The security vendor’s H1 2023 Email Threat Report reveals worrisome corporate security
challenges associated with the workforce. Under the massive spike of BEC attacks, the median
open rate for text-based BEC emails during the second half of 2022 reached 28 per cent, with
15 per cent of employees responding to malicious content.
When it comes to email attacks, human risk cannot be ignored. Attackers are increasingly
innovating new social engineering tactics to lure employees into opening malicious emails and
handing in sensitive information like providing login credentials and updating bank account
information.
While BEC attacks target all levels of employees, the report found that 78 per cent of attacks
were read and replied to by entry-level sales associates. Industry-wise, employees in the
transportation sector (16%) were most likely to respond to attacks, followed by automotive
(9%) and healthcare (8%). The increased sense of urgency regarding maintaining operations and
resolving issues quickly might explain the high response rate in the transportation sector, the
report suggested.
To fundamentally mitigate the BEC threat, Abnormal Security CISO Mike Britton said companies
should not entirely rely on the training of staffers. Instead, they should implement
technological solutions.
“While employees have to be right 100 per cent of the time, threat actors only need to be right
once — and attackers know this,” Britton said in the report.
“Because advanced email attacks like business email compromise and supply chain compromise
exploit trusted email accounts and relationships, organizations need email security that can
detect even small shifts in activity and content,” he added. “By doing so, they can block these
attacks before employees have to make a choice on whether to ready, reply to, or report
them.”

Despite the law enforcement efforts to disrupt BEC cybercrime operations worldwide, attackers
made US$2.4 billion globally in 2021 from attacks reported to the FBI, which is 49 times as
much as reported ransomware’s yield (US$49.2 million) and takes up a third of total cybercrime
gains (US$6.9 billion).
https://www.scmagazine.com