Types of BEC Attacks

Understanding different BEC variants helps in recognition and prevention:

CEO Fraud: Attackers impersonate C-level executives, typically targeting finance employees with urgent wire transfer requests. Messages often cite confidential acquisitions, legal settlements, or time-sensitive opportunities. The authority of the supposed sender and urgency of the request overwhelm normal verification procedures.

Account Compromise: Criminals gain access to legitimate email accounts through phishing or credential theft, then use these accounts to request payments or sensitive data. These attacks are particularly effective because emails come from actual company accounts.

False Invoice Schemes: Attackers impersonate vendors and request payment to fraudulent accounts. They often claim banking details have changed or that urgent payment is needed to avoid service disruption. Long-standing vendor relationships are particularly vulnerable.

Attorney Impersonation: Fraudsters pose as lawyers handling confidential matters, often claiming to represent the CEO in sensitive legal issues. The confidential nature of supposed legal matters discourages verification.

Data Theft: Not all BEC aims for immediate financial gain. Some attacks target employee W-2 forms, tax information, or other sensitive data for identity theft or future attacks. HR departments are common targets during tax season.