Business Email Compromise (BEC) Attempt
Company Context
Business Type: Small marketing agency (15 employees)
Regular Vendor: Web hosting provider
Typical Invoice Amount: $450-550 monthly
Payment Method: Bank transfer
Attack Details
Initial Contact
Date: January 28, 2024
Time: 10:15 AM (right after real vendor's usual invoice time)
Sender: accounting@webhost-solutions.net (real vendor: @webhostsolutions.com)
Subject: Invoice #INV-2024-028 - Payment Due
Email Content Analysis
- Header: Perfect replica of vendor's template
- Logo: High-resolution copy
- Contact Info: Same phone numbers, different email
- Invoice Details:
- Amount: $495.00 (typical amount)
- Due Date: Net 15 (same terms)
- Account #: Similar but different format
- Bank Details:
- Different bank name
- New account number
- Same branch location (to appear legitimate)
Detection Process
- Initial Review: Passed quick check (amount, timing correct)
- Payment Processing: Started preparing bank transfer
- Verification Step: Compared to last month's invoice
- Discrepancies Found:
- Email domain difference (missing 's' in host)
- Account number format changed
- Invoice number sequence different
- Verification Call: Contacted vendor directly, confirmed scam
Attack Analysis
Likely Methods
- Email Monitoring: Attacker knew typical invoice amounts/timing
- Template Theft: Previous invoices likely intercepted
- Spoofing: Email headers crafted to appear legitimate
- Social Engineering: Pressure through "payment due" urgency
Potential Impact
- Immediate Loss: $495.00
- Future Risk: Marked as vulnerable target
- Vendor Relationship: Could have been damaged
- Time Cost: 4+ hours recovery if paid
Response Actions
- Internal:
- Alerted all staff about BEC attempt
- Updated payment verification procedures
- Implemented dual-approval for vendor changes
- External:
- Notified real vendor about impersonation
- Reported to FBI IC3
- Shared with industry group
- Filed Quiet-Report
Security Improvements Implemented
- Vendor verification checklist
- Payment approval workflow changes
- Email filtering rules for similar domains
- Regular security training updates
Technical Details
- Sender IP: 45.153.64.28 (Bulgaria)
- SPF/DKIM: Failed (missed in initial review)
- Reply-to: payments@webhost-solution.net (different again)