Business Email Compromise (BEC)

In March 2018, the Dutch subsidiary of Pathé wired about 19 million euros on the strength of emails presented as coming from Paris headquarters, for a supposedly confidential acquisition. Its two top executives were fired. No system was hacked: the transfers were ordered by the people with authority to order them. CEO fraud is the textbook case of business email compromise (BEC). By email, the attacker impersonates an executive, a supplier or a partner, and gets an authorized employee to send an urgent, confidential wire to an account they control. The weapon is manipulation, working on authority, urgency and secrecy. Its cousin, vendor impersonation fraud, gets bank details changed ahead of a real invoice. The FBI puts reported BEC losses in the billions of dollars every year, far ahead of reported ransomware losses. In June 2015, Ubiquiti Networks lost 46.7 million dollars in wire transfers ordered by fake emails from its management and recovered only 8.1 million, according to its August 8-K. In France the scheme is called FOVI, faux ordre de virement. Sometimes the attacker only spoofs the header without touching the account; elsewhere the mailbox itself is compromised, and voice or video deepfakes of the executive are spreading. For insurers, BEC falls between two policies. The employee gave the instruction, which often takes it outside a crime policy written for loss caused by a third party, sometimes with an outright voluntary parting exclusion. The market therefore handles it under social engineering fraud cover, usually sub-limited, sometimes excluded from the cyber policy altogether. The application form checks for dual sign-off on transfers and for callback verification of suppliers through a second channel, on a number already on file.