Business Email Compromise vs. Phishing

The cybersecurity world is riddled with terms that seem to overlap, which can cause confusion when users are trying to learn more about the subject.

For example, all ransomware is considered malware, but not all malware is ransomware, and while all viruses fall under the umbrella of malware, not all malware is a virus. To make matters worse, sometimes organizations use the terms interchangeably when they really shouldn’t.

Another example of terms that can be confusing when compared to each other is business email compromise, also known as BEC, and phishing. Both are forms of cyberattacks, but they differ in their methods, targets, and objectives.

Business Email Compromise

BEC typically targets businesses, executives, or employees with access to financial or sensitive information. Organizations of all types, from all industries, and of all sizes can be targeted by BEC. Some cybercriminal groups target very specific organizations, and some will attack just about any they can gain a foothold inside.

In a BEC attack, the attackers usually impersonate a trusted individual, such as a CEO, vendor, or partner, by compromising or spoofing that person’s or organization’s email account. The attackers use that account that is generally trusted by the recipient to send highly targeted and convincing emails to manipulate the recipient into taking specific actions, such as transferring funds or sharing confidential data.

The objective of BEC attacks like this is financial gain or theft of sensitive business information. Attackers can find success in having an unsuspecting employee wire money directly into their account, or they can sell the information they obtain during the attack on the dark web.

BEC attacks are often more sophisticated and personalized, relying on social engineering rather than malicious links or attachments.

It is important to note that in traditional BEC attacks, the direct email approach spoofs executives, exploits organizational hierarchies, and uses urgent demands for financial payments and transfers. Sometimes, the cybercriminals go even further, developing elaborate deceptions that involve long and complex reply threads that are placed in their malicious emails with the correct executive names, and even their tone, to make their emails even more convincing.

Phishing

Phishing can target pretty much anyone, including individuals, employees, or businesses. Phishing is definitely more of a broad approach where thousands of emails are sent to thousands of email addresses without any real consideration of who the recipients are in most cases. Phishing is definitely more of a numbers game – the more phishing emails sent, the better the chance someone who receives the email will click on the malicious links or attachments in the email.