S5, E226 - Building a Secure Culture Against BEC Scams

Send us a text

Discover how these cyber criminals impersonate bosses and coworkers, manipulating emotions to trick victims into transferring money or revealing sensitive information. Learn how to spot the red flags: from urgent requests that cloud judgment, to lookalike email domains designed to deceive. We'll guide you through practical steps to safeguard your organization, emphasizing the importance of communication and verifying requests through trusted channels.

Join me, Cameron Ivey, as I break down these sophisticated scams and explore why adherence to company protocols is crucial in defending against them. 

Support the show

Episode Transcript

Speaker 1 (00:00):
All righty, then.
Ladies and gentlemen, welcomeback to another episode of
Privacy, please.
I'm your host, cameron Ivey,and this is the show where we
break down complicated techstuff into bits everyone can
understand.
Today, we're going to beexploring the insidious world of
business email compromise, alsoknown as BEC scams, a $26

(00:22):
billion criminal enterprise,according to the FBI.
Let's dig in.
Business email compromise scamsinvolve con artists
impersonating your boss orcoworkers to trick you into

(00:44):
transferring money or divulgingsensitive information.
Here's how to spot them andstop them.
Number one question urgency.
Scammers rely on creating afalse sense of urgency to cloud
your judgment.
Ronnie Takasowski, a seasonedsecurity researcher, emphasizes
if an email elicits an emotionalresponse, take a step back and

(01:08):
reread it when you're more calm.
Sleep on it.
Take a second.
Don't respond right away.
This emotional manipulation iskey to their success.
Selena Larson from Proofpointadvises slow down, take a deep
breath and walk away from yourcomputer or phone and think
critically.
Number two confirm through asecond channel.

(01:30):
Always verify suspiciousrequests through a different
communication method.
Larson's warns do not rely on aphone number in the email
itself.
It will be owned by the threatactor.
Use the known contact detailsof secure channels like Slack or
Microsoft Teams.
Even if the request seemsurgent, it's crucial to confirm
its authenticity.
Number three check the emailaddress.

(01:50):
Examine the sender's emailaddress closely.
Scammers often use lookalikedomains to appear legitimate.
Larson notes that lookalikedomains are very common.
Someone will do a slightvariation, like a capital I
instead of a lowercase I to makeit look legitimate.
If you're suspicious, paste thedomain into a browser to verify

(02:11):
its authenticity.
Just take that extra step.
The next one is follow properprotocols.
Stick to established companyprocedures for financial
transactions and informationupdates.
Another source points out thereneeds to be a paper trail.
Someone saying purchase thisfrom your personal account is a
process that just wouldn'thappen.
So if it seems weird oruncommon or you feel like those

(02:35):
spider tinglys oh yeah, we gotthem Go with your instinct on
that.
The next one is foster opencommunication.
This is key.
Leaders should cultivate aculture of transparency anywhere
right.
One of the sources suggeststhat skip level meetings to
enhance communication across alllevels of the organization.
Larson's adds that talkingabout scams openly helps the

(02:56):
person, their peers and theircolleagues learn how to protect
themselves.
Build that confidence withinyour team.
By staying vigilant and havingopen communication, you can
protect yourself and yourorganization from these
sophisticated scams.
Remember it's better to verifyand be safe than assume and be
sorry, andy sawy.
That's all for this week, folks.

(03:17):
If you want to learn more, feelfree to reach out and we'll
catch you guys on the next one.
Cameron Ivey, over and out.