On June 9 the FBI released a public service announcement (PSA) addressing new information and statistics on cyberattacks related to business email compromise (BEC), with an emphasis on a recent increase in such attacks targeting the real estate sector. The PSA also sets forth recommendations for security measures organizations should implement to mitigate cyber risks in this area.
Business Email Compromise Scams
A BEC is a cyberattack technique whereby malicious actors assume the identity of a trusted person (e.g., customer, service provider, third-party agent) in an attempt to trick the recipient into taking a desired action, such as changing financial payment instructions or divulging sensitive corporate information or personal data.
According to the FBI’s PSA, BEC scams have continued to evolve, targeting small local businesses to larger corporations and personal transactions. Between December 2021 and December 2022, the FBI reports that there was a 17% increase in identified global exposed losses.
The FBI also reports that banks located in Hong Kong and China were the primary international destinations of fraudulent funds, followed by the United Kingdom, which often acts as an intermediary stop for funds, Mexico, and Singapore.
According to the PSA, there has been over $50 billion in losses related to BEC attacks since 2013.
Real Estate Targeted
The PSA also details an increase in BEC scams targeting the real estate sector. It provides that BEC scams target all participants in real estate transactions (e.g., buyers, sellers, real estate attorneys, title companies, and agents), and “[o]nce BEC perpetrators gain access to a participant’s email account involved in a real estate transaction, they are able to monitor the real estate proceeding” and use their access to commit wire or fund transfer fraud.
According to the FBI, BEC scams targeting the real estate sector are “once again on the rise” and from calendar years 2020 to 2022, there was a 27% increase in reported BECs with a real estate nexus. During the same time frame, there was a 72% increase in victim losses from BECs involving real estate. According to the FBI, “[t]he increases in victim losses of BEC with a real estate nexus are notable with the increase in victim reporting and also may be contributed to the rise in real estate costs over the last several years.”
Steps to Protect Against BEC Scams
The FBI recommends the following precautions that organizations should implement to protect against BEC scams:
- Utilize two-factor authentication
- Verify a URL is accurate and associated with the business or individual it is from
- Check for misspellings in hyperlinks within emails
- Refrain from providing personal information via email and exercise caution with emails requesting such information
- Verify that an email address matches who appears to be sending the email
- Ensure the settings in employees’ computers allow full email extensions to be viewed
- Monitor financial accounts for irregularities
The FBI’s recommendations are especially important because they align with a recent proposal from the National Institute of Standards and Technology to update its information security guidelines for the private sector. Organizations should carefully assess their information security programs against these FBI recommendations and the NIST guidelines or other applicable industry standards to identify and mitigate cybersecurity risks, including BECs.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.
This document may be considered attorney advertising in some jurisdictions.
© 2023 THOMPSON HINE LLP. ALL RIGHTS RESERVED.
