Business Email Compromise

Part of the Security Fundamentals section of Coddy's Cybersecurity journey. Lesson 31 of 43.

Imagine someone steals access to your landlord's email account. They send you new bank details and ask you to pay your rent there. The message really came from the landlord's address, but the money would go to the thief. This is an example of business email compromise.

Before changing where you pay, call the landlord using a number you already have, such as the one in your contract. Do not use a new number from the suspicious email, because that could belong to the thief too.

When a ticket asks how you would check a request like this, record your answer:

seclab answer verification call the number in the contract

You should see:

Recorded your answer to verification.

Checking the request through a contact you already trust helps even when the email came from a real account.

Challenge

Easy

Ticket from Omar, finance

An email from Beanly asks me to change its bank details and pay now. It passed the sender checks, but I have not confirmed the bank change. Quarantine it before I pay and mark it as phishing. Read our saved supplier contact record and record how we should check the request. Keep the ordinary invoice available.

Try it yourself

Terminal

All lessons in Security Fundamentals

2Phishing

Phishing Look-Alike Domains Who Clicked The Second Wave

5Email Attacks

Reply-To Dangerous Attachments Where an Email Came From The Invoice QueueBusiness Email CompromiseBlocking a Sender Mailbox Rules The Phishing Reports

3Access Control

Groups Least Privilege Admin Rights The New Hire Leavers Shared Accounts Separation of Duties The Access Review

6Rules of the Job

Authorization No Hacking Back The Vendor's Call