How to Spot Fake Business Email Compromise (BEC) Attacks Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake Business Email Compromise (BEC) Attacks Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

Business Email Compromise (BEC) is a targeted form of cybercrime where attackers impersonate a trusted executive, supplier, or colleague to trick employees into making fraudulent payments or sharing sensitive data. Unlike broad phishing campaigns, BEC attacks are highly personalised and often bypass traditional spam filters because they originate from legitimate-looking email accounts. Australian small businesses are frequent targets, particularly when processing invoices or payroll changes.

Common Warning Signs of a BEC Attack

Unexpected Payment Requests

Be suspicious of any email requesting an urgent payment, a change to bank account details, or the purchase of gift cards. Scammers often create a sense of pressure to prevent you from verifying the request.

Subtle Email Address Changes

Check the sender's address carefully. Attackers often use lookalike domains, such as replacing the letter "o" with the number "0" or adding an extra character. For example, [email protected] might become [email protected].

Changes to Communication Style

If an email from a manager or supplier suddenly uses unusual language, avoids phone calls, or demands secrecy, treat it with caution. BEC attackers often claim they are in a meeting or travelling to avoid voice verification.

Invoice and Banking Detail Changes

A supplier claiming they have changed their bank account is one of the most common BEC tactics. Always verify these requests through a known, trusted contact method before updating your records.

Step-by-Step Verification Process

1. Do not reply to the suspicious email or use any contact details provided in the message.
2. Contact the sender using a phone number you already have on file or look up their official business details independently.
3. Check the email header to verify the actual sending address. In Microsoft Outlook, open the email, select File, then choose Properties to view the internet headers.
4. Compare the sender's email address against previous legitimate correspondence from the same organisation.
5. If the request involves a payment or banking change, require a second staff member to authorise the transaction before funds are transferred.
6. If you confirm the email is fraudulent, do not delete it immediately. Forward it to your IT provider or retain it for evidence.

How to Protect Your Business Email

• Enable multi-factor authentication (MFA) on all business email accounts. In Microsoft 365, go to the Microsoft Entra admin center, select Users, then Active users, and configure MFA for each account.
• Train staff to verify payment requests by phone or in person, especially when banking details change.
• Implement a dual-authorisation process for all payments above a set threshold.
• Regularly analyse email forwarding rules. In Outlook on the web, select the Settings gear icon, go to Mail, then Forwarding, and remove any rules you did not create.
• Keep your operating systems and email applications updated to patch known security vulnerabilities.

Note: If you suspect a BEC attack has succeeded and funds have been transferred, contact your bank immediately to request a recall of the funds. Time is critical in these situations.

Warning: Never click links or open attachments in unexpected emails, even if they appear to come from a known supplier. These may lead to fake login pages designed to steal your credentials.

Reporting a Suspected Attack

If you receive a suspicious email or believe your business has been targeted, you can report it to the Australian Cyber Security Centre (ACSC) through cyber.gov.au. You should also contact your IT support provider so our team can help secure your email environment and investigate the attempt.

Still Having Issues?