--- title: Don't fall victim to the $43 billion dollar scam description: steps to take to avoid business email compromise image: https://koppingerins.com/hubfs/business-email-compromise-800x400.jpg --- [![Koppinger & Associates logo](https://koppingerins.com/hs-fs/hubfs/01609-KA-Logo-CC-1.png?width=1800&height=384&name=01609-KA-Logo-CC-1.png "Koppinger & Associates logo")](https://koppingerins.com) [![Koppinger & Associates logo](https://koppingerins.com/hs-fs/hubfs/01609-KA-Logo-CC-1.png?width=1800&height=384&name=01609-KA-Logo-CC-1.png "Koppinger & Associates logo")](https://koppingerins.com) - [Home](https://koppingerins.com) - Solutions - [Business insurance & P&C](https://koppingerins.com/business-insurance-pc-solutions) - [Employee benefits & HR](https://koppingerins.com/employee-benefits-and-hr-solutions) - [Knowledge Center](https://koppingerins.com/blog) - [About](https://koppingerins.com/about) - [Contact](https://koppingerins.com/contact) - [HR Library](https://auth.zywave.com) # Don't fall victim to the $43 billion dollar scam April 06 2023 Categories: [Business Insurance](https://koppingerins.com/blog/tag/business-insurance) ![Don't fall victim to the $43 billion dollar scam](https://koppingerins.com/hubfs/business-email-compromise-800x400.jpg) You depend on your finance team to handle incoming and outgoing financial transactions.  What happens when it appears you have satisfied a payment obligation only to discover funds have been transferred to a fake account?  The money is gone, but until the correct party is paid you remain liable. Business email compromise (BEC) is a sophisticated social engineering attack that enables criminals to cash in on an easy payday.  BEC involves an email message that appears to come from a known source making a legitimate request, like the following examples: - A vendor your company regularly deals with sends an invoice with updated banking account information - A vendor your company regularly deals with sends an invoice directing payment be sent to a different address than normal - A company CEO requests the purchase of multiple gift cards to send out as employee rewards and requests the serial numbers be emailed back so the cards can be sent out right away **Best Defense to Prevent becoming a Victim of BEC** Adopt a "zero trust" email policy and educate **all** of your employees on basic cybersecurity protocols, including the following: - Educate employees, clients, and vendors to: - Authenticate all financial transactions through dual-factor authentication, for example logging in with a password and then receiving a text or email message to confirm who is logging in - Confirm all payment method changes using trusted and authenticated information, for example verify odd payment requests by contacting the requestor on a known phone line, not the number given in the email - Learn the habits of those with whom they conduct financial transactions - How to detect phishing emails by providing examples and guidance on how to verify suspicious emails - Effective password management and encryption protocols for internal and external emails - Avoid responding to emails that are suspicious or from unknown sources - Locking and encrypting access to computers and files containing sensitive information - Implementing guidelines for maintaining and communicating sensitive data - Implementing protocols on how to request and respond to requests for sensitive employee information and how to securely send such information through a secure file transfer system - Enable multi-factor authentication - Conduct BEC drills, similar to anti-phishing exercises. The best way to spot a fake email is to scrutinize it.  Teach employees to pay attention to the following: - Language and Grammar - Is this the way the impersonated individual would speak?  If unsure, call the person on a known phone line to verify the email was sent by them - Sender information that doesn’t match the email address  - Spelling mistakes - Urgency of request - requestor is unreachable but insists the transfer is urgent - Emails containing unsolicited attachments and links Michigan State Police resources available at [Michigan Cyber Command Center (MC3)](https://link.edgepilot.com/s/97812bf0/aAP9IFfTb0qIDg-Z6PPjIg?u=https://koppingerins.us4.list-manage.com/track/click?u=713987f7ce6412fef43a40f3d%26id=ad4253a323%26e=6b067dc2a6) What if a BEC Email is Responded to If you suspect you responded to a BEC phishing attempt and revealed some contact details or other privileged information, do the following: 1. **Immediately report the incident** to your organization’s IT/cyber security team 2. **Notify your bank**, credit card provider, and financial institution of the scam 3. Request your bank to **suspend all transactions** 4. **Change passwords** for email and financial accounts 5. Look through account statements for any suspicious activity 6. **File a police report** **What if You Fall Victim to a BEC Scam** - An immediate response is crucial, funds are moved within minutes of a BEC incident - Contact your **bank** to reverse the wire - Contact **local law enforcement** to request a report, which is needed to reverse a wire - Contact a **Secret Service** field office [Cyber Fraud Task Force](https://link.edgepilot.com/s/94ada865/1Ny_PhJbhEyrXwoRklC7PA?u=https://koppingerins.us4.list-manage.com/track/click?u=713987f7ce6412fef43a40f3d%26id=90fc980d41%26e=6b067dc2a6) - Law enforcement can work with [FinCEN](https://link.edgepilot.com/s/6a05c70c/JH35r5iHGEei3v2AQ-6gbA?u=https://koppingerins.us4.list-manage.com/track/click?u=713987f7ce6412fef43a40f3d%26id=f0a0e42d58%26e=6b067dc2a6) to initiate Financial Fraud Kill Chain - File a complaint with the[ Internet Crime Complaint Center (IC3)](https://link.edgepilot.com/s/003b98db/v6ISZL7QX0WS6JG9tC2y3w?u=https://koppingerins.us4.list-manage.com/track/click?u=713987f7ce6412fef43a40f3d%26id=5b86e99162%26e=6b067dc2a6) - Review **email systems** for unauthorized access or rule creation - Conduct a **cyber security analysis** on your systems - Change all **login credentials**   **The threat of BEC is an increasing problem for all businesses.  Now is the time to evaluate and update your cyber security plan.  No plan means no protection.  Koppinger & Associates has resources to help, contact us.**   - - - - [mailto:?subject=Dont%20fall%20victim%20to%20the%20$43%20billion%20dollar%20scam&body=Dont%20fall%20victim%20to%20the%20$43%20billion%20dollar%20scam%20https://koppingerins.com/blog/dont-fall-victim-to-the-43-billion-dollar-scam](mailto:?subject=Dont%20fall%20victim%20to%20the%20$43%20billion%20dollar%20scam&body=Dont%20fall%20victim%20to%20the%20$43%20billion%20dollar%20scam%20https://koppingerins.com/blog/dont-fall-victim-to-the-43-billion-dollar-scam) [Previous post](https://koppingerins.com/blog/your-brand-is-one-of-your-biggest-assets-are-you-protecting-it) [All posts](https://koppingerins.com/blog) [Next post](https://koppingerins.com/blog/contractual-risk-management-crt-what-does-it-mean-why-does-it-matter) ## Related Articles #### [Don't Risk Penalties and Legal Consequences](https://koppingerins.com/blog/dont-risk-penalties-and-legal-consequences) #### [Think You Don't Have An Environmental Exposure? PFAS Might Change Your Mind. - Koppinger & Associates](https://koppingerins.com/blog/think-you-dont-have-an-environmental-exposure-pfas-might-change-your-mind) #### [Customers Don't Expect You to be Perfect; They do Expect you to Fix Things that Have Gone Wrong](https://koppingerins.com/blog/customers-dont-expect-you-to-be-perfect-they-do-expect-you-to-fix-things-that-have-gone-wrong) [![01609-KA-Logo-WH](https://koppingerins.com/hs-fs/hubfs/01609-KA-Logo-WH.png?width=300&height=64&name=01609-KA-Logo-WH.png "01609-KA-Logo-WH")](https://20500700.hs-sites.com/) 3060 Commerce Dr. Suite 4 Fort Gratiot, MI 48059 At Koppinger & Associates, we are a team of dedicated insurance advisors who put the needs of our clients first. Through a personalized approach, we help guide you to the right insurance solutions for your business while treating you with care and excellence. [Follow us on LinkedIn](https://www.linkedin.com/company/koppinger-%26-associates/) ### Company - [Home](https://koppingerins.com) - [Business Insurance](https://koppingerins.com/business-insurance-pc-solutions) - [Employee Benefits](https://koppingerins.com/employee-benefits-and-hr-solutions) - [About](https://koppingerins.com/about) ### Resources - [Knowledge Center](https://koppingerins.com/blog) - [Contact](https://koppingerins.com/contact) Copyright © 2022. All Rights Reserved. | [Privacy Policy](https://koppingerins.com/privacy-policy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Koppinger & Associates", "url" : "https://koppingerins.com/blog/author/koppinger_associates" }, "dateModified" : "2023-04-06T17:00:08.766Z", "datePublished" : "2023-04-06T17:00:08.000Z", "headline" : "Don't fall victim to the $43 billion dollar scam", "mainEntityOfPage" : { "@id" : "https://koppingerins.com/blog/dont-fall-victim-to-the-43-billion-dollar-scam", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://koppingerins.com/hubfs/01609-KA-Logo-CC-1.png" }, "name" : "Koppinger & Associates, Inc." } } ```