Help & FAQs

Test Title

Business email compromise scams (BEC) are on the rise. Scammers know businesses rely on emails to conduct day to day business making them unique and lucrative targets for these types of scams. This type of scam can affect businesses of any type or size.

The results of these attacks can be financially devastating and can cause lasting reputation concerns.

Scammers use a variety of avenues including:

• Sending updated payment instructions (address, wiring instructions) that appear to come from a regularly paid vendor.
• Sending out a request for a fake payment or gift card purchase from a company executive.
• Takeover of your email account.
  • This allows a scammer to redirect legitimate emails so you don't see them, reset passwords to sites including mobile phone providers, and bank accounts.

• Examine incoming messages:
  • Don't click on any links within emails or text messages. Type in the address to the website of the vendor, retailer, or creditor directly into your browser.
  • Click on the sender information of an email; things that appear to come from legitimate vendors may in fact come from other illegitimate sources.
  • Never download attachments from individuals you do not know.
• Set up multi-factor authentication on any account that offers including mobile phone and email accounts.
• Verify any changes to contact info or payment instructions by phone before paying.
• Use a unique password, not repeated anywhere else just for your email.
• Regularly check archive folders, rules, trash, and sent folders to ensure nothing is amiss.
• Protect yourself with a cyber insurance policy.
• Invest in anti-virus software that can alert you to suspicious emails and websites.
• Do not share personal information on social media including answering quizzes or questions about favorite things. Many of these quizzes share answers to security questions that you have set up.
• Educate your staff on business email compromises.

• Contact your financial institution immediately to lock down your accounts.
• They can also assist in contacting the FBI Recovery Asset Team and the Financial Institution where the fraudulent funds were sent. The first 24 hours are critical.
  • You or your financial institution need to file a complaint with the FBI's Internet Crime Center (ic3.gov)
• Contact your insurance company if you have a cyber insurance policy.
• Reset your email password.
• Begin investigating how the compromise occurred.
• Document everything in case it is needed by your financial institution or the authorities.