Lesson 7

When Your Boss Isn't Your Boss

Business Email Compromise

The Long Con

Angela in finance receives an email from her CFO, David:

This looks completely legitimate. It's from David's real email address. The writing style matches his patterns. There really was a vendor discussion last week. Angela processes the wire transfer.

Except David's email account had been compromised weeks ago. Attackers read his emails, learned his writing style, and waited for the perfect moment.

How BEC Attacks Work

1

Compromise: Attackers gain access to an executive's email via phishing or password breach

2

Reconnaissance: They read emails silently for weeks, learning relationships, projects, writing styles

3

Setup: They set up email rules to hide their activity and monitor for wire transfer opportunities

4

Strike: They send a perfectly timed, contextually accurate request for a wire transfer

Why These Attacks Succeed

  • The email comes from a real, legitimate address
  • It references actual ongoing projects
  • The writing style matches the real person
  • The amount is plausible for normal business
  • There's artificial urgency but not panic-level

Defense Strategies

1
Verify All Wire Transfers by Phone

Use a known number (not from the email) to confirm every wire request

2
Implement Dual Authorization

Require two people to approve wire transfers over a threshold

3
Watch for Payment Detail Changes

"Please use these new bank details" is a major red flag

4
Slow Down

Urgency is a manipulation tactic. Real business can wait for verification

Test Your Knowledge

Answer these questions to complete the lesson.

1. What made the attack on Angela so convincing?

2. What should Angela have done before processing the wire transfer?

3. Why do attackers often wait weeks after compromising an email account?

4. A vendor emails to say their bank account has changed and future payments should go to a new account. What should you do?

All Lessons