Close Menu
TechCentralTechCentral

    Subscribe to the newsletter

    Get the best South African technology news and analysis delivered to your e-mail inbox every morning.

    Facebook X (Twitter) YouTube LinkedIn
    WhatsApp Facebook X (Twitter) LinkedIn YouTube
    TechCentralTechCentral
    • News

      10 red flags for Apple investors

      13 June 2025

      Chief sub-editor wanted – help shape South African tech media

      13 June 2025

      MultiChoice may unbundle SuperSport from DStv

      12 June 2025

      MVNO boom is reshaping South Africa’s mobile market

      12 June 2025

      South African law is failing gig-economy workers

      12 June 2025
    • World

      Yahoo tries to make its mail service relevant again

      13 June 2025

      Qualcomm shows off new chip for AI smart glasses

      11 June 2025

      Trump tariffs to dim 2025 smartphone shipments

      4 June 2025

      Shrimp Jesus and the AI ad invasion

      4 June 2025

      Apple slams EU rules as ‘flawed and costly’ in major legal pushback

      2 June 2025
    • In-depth

      Grok promised bias-free chat. Then came the edits

      2 June 2025

      Digital fortress: We go inside JB5, Teraco’s giant new AI-ready data centre

      30 May 2025

      Sam Altman and Jony Ive’s big bet to out-Apple Apple

      22 May 2025

      South Africa unveils big state digital reform programme

      12 May 2025

      Is this the end of Google Search as we know it?

      12 May 2025
    • TCS

      TechCentral Nexus S0E1: Starlink, BEE and a new leader at Vodacom

      8 June 2025

      TCS+ | The future of mobile money, with MTN’s Kagiso Mothibi

      6 June 2025

      TCS+ | AI is more than hype: Workday execs unpack real human impact

      4 June 2025

      TCS | Sentiv, and the story behind the buyout of Altron Nexus

      3 June 2025

      TCS | Signal restored: Unpacking the Blue Label and Cell C turnaround

      28 May 2025
    • Opinion

      Beyond the box: why IT distribution depends on real partnerships

      2 June 2025

      South Africa’s next crisis? Being offline in an AI-driven world

      2 June 2025

      Digital giants boost South African news media – and get blamed for it

      29 May 2025

      Solar panic? The truth about SSEG, fines and municipal rules

      14 April 2025

      Data protection must be crypto industry’s top priority

      9 April 2025
    • Company Hubs
      • Africa Data Centres
      • AfriGIS
      • Altron Digital Business
      • Altron Document Solutions
      • Altron Group
      • Arctic Wolf
      • AvertITD
      • Braintree
      • CallMiner
      • CYBER1 Solutions
      • Digicloud Africa
      • Digimune
      • Domains.co.za
      • ESET
      • Euphoria Telecom
      • Incredible Business
      • iONLINE
      • Iris Network Systems
      • LSD Open
      • NEC XON
      • Network Platforms
      • Next DLP
      • Ovations
      • Paracon
      • Paratus
      • Q-KON
      • SkyWire
      • Solid8 Technologies
      • Telit Cinterion
      • Tenable
      • Vertiv
      • Videri Digital
      • Wipro
      • Workday
    • Sections
      • AI and machine learning
      • Banking
      • Broadcasting and Media
      • Cloud services
      • Contact centres and CX
      • Cryptocurrencies
      • Education and skills
      • Electronics and hardware
      • Energy and sustainability
      • Enterprise software
      • Fintech
      • Information security
      • Internet and connectivity
      • Internet of Things
      • Investment
      • IT services
      • Lifestyle
      • Motoring
      • Public sector
      • Retail and e-commerce
      • Science
      • SMEs and start-ups
      • Social media
      • Talent and leadership
      • Telecoms
    • Events
    • Advertise
    TechCentralTechCentral
    Home » Company News » You are the weakest link: how to stop the costliest Internet scam

    You are the weakest link: how to stop the costliest Internet scam

    By ESET25 May 2022
    Twitter LinkedIn Facebook WhatsApp Email Telegram Copy Link
    News Alerts
    WhatsApp
    ESET Southern Africa’s Steve Flynn

    According to Steve Flynn, sales and marketing director at ESET Southern Africa, it’s long past time organisations got a handle on business e-mail compromise scams that generated more losses for victims in 2021 than any other type of cybercrime.

    While ransomware, hacking, API hacks and all the other cybersecurity threats make headlines, it’s worth remembering that the costliest Internet scam is still business e-mail compromises, according to the latest FBI Internet Crime Report.

    Among the complaints received by the FBI in 2021, ransomware, business e-mail compromise (BEC) schemes and the criminal use of cryptocurrency are among the top incidents reported. Technology-based systems are under attack, and they cost organisations around the world billions of dollars in lost funds.

    For more information, visit www.eset.com/za

    The FBI’s Internet Crime Report for 2021 correlates with what we see in South Africa; business e-mail compromises remain one of the most concerning threat vectors because the weakest link is not something that can be easily patched: the human being. The adage of people being the weakest link in security is especially true when it comes to e-mail threats. Here, cybercriminals can arguably generate their biggest “bang-for-buck” by using social engineering tactics on their targets and persuading them to follow instructions.

    Despite the great efforts that employee organisations and financial institutions go through to educate customers and staff on what to avoid, many still fall victim, unknowingly providing access to cybercriminals. Phishing is the most obvious example of these efforts.

    The one specific type of cybercrime leveraging phishing messages is business e-mail compromise and it has been the highest-grossing of any criminal activity over the past few years.

    The latest FBI Internet Crime Report reveals that once again in 2021, these scams generated more losses for victims than any other type of cybercrime.

    It’s time that organisations got a handle on e-mail compromises and developed a layered, defensive approach to mitigate the risk of losing large sums of money to faceless fraudsters.

    The report reveals that while only 19 954 complaints of BEC were received last year – far behind the leading complaints of phishing (324 000), non-payment/non-delivery (82 000) and personal data breach (52 000) – the loss of US$2.4-billion through BEC is of a far higher value than any of the more reported crimes in the list.

    While this means that it might seem as much of a problem as the other types of fraud because the case number is lower, it’s the one type of fraud that costs businesses the most: an 82% percent increase over 2020 and almost a third of all cybercrime losses in 2021.

    How does BEC work?

    At a simple level, BEC is a type of social engineering. Members of finance teams are usually targeted by someone they believe to be a senior executive or CEO that wants an urgent money transfer to happen, or potentially a supplier that requires payment.

    As implausible as it sounds, these scams occasionally still work because the victim is usually pressured to act, without being given time to think through the consequences of their actions – classic social engineering. Sometimes fraudulent invoices with updated banking details are all that is required.

    It only needs to work occasionally to make it worth the while of a fraudster.

    Because these attacks do not use malware, they’re harder for organisations to spot. AI-powered e-mail security solutions are getting better at detecting suspicious behavioural patterns which can indicate when a sender may have been spoofed.

    User awareness training and updated payment processes are therefore a critical part of layered BEC defence.

    What the future holds

    The bad news for network defenders is that the scammers are still innovating. The FBI warned that deepfake audio and video conferencing platforms are being used in concert to deceive organisations nowadays.

    Deepfake audio has already been used to devastating effect in two standout cases. In one, a British CEO was tricked into believing his German boss requested a €220 000 money transfer. In another, a bank manager from the UAE was duped into transferring $35-million at the request of a “customer”.

    This kind of technology has been with us for a while. The concern is that it’s now cheap enough and realistic enough to trick even expert eyes and ears. The prospect of spoofed video-conferencing sessions not only using deepfake audio but also video is a worrying prospect for chief information security officers and risk managers.

    What can I do to tackle BEC?

    The FBI, security industry bodies and companies like ESET are doing their best to disrupt BEC gangs where they operate. But given the huge potential profits on offer, arrests will not deter cybercriminals, which is why prevention is always the best strategy.

    Organisations need to consider the following:

    • Invest in advanced e-mail security that leverages AI to discern suspicious email patterns and sender writing styles.
    • Update payment processes so that large EFT transfers must be signed off by two employees.
    • Double check any payment requests again with the person allegedly making the request.
    • Build BEC into staff security awareness training such as in phishing simulations.
    • Keep updated on the latest trends in BEC and be sure to update training courses and defensive measures accordingly.

    Like any fraudsters, BEC actors will always go after low-hanging fruit. Organisations need to make themselves a harder target, which will hopefully lead to opportunistic scammers turning their attention elsewhere.

    About ESET
    For more than 30 years, ESET has been developing industry-leading IT security software and services to protect businesses, critical infrastructure and consumers worldwide from increasingly sophisticated digital threats.

    From endpoint and mobile security to endpoint detection and response, encryption and multifactor authentication, ESET’s high-performing, easy-to-use solutions unobtrusively protect and monitor 24/7, updating defences in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company that enables the safe use of technology. This is backed by ESET’s R&D centres worldwide, working in support of our shared future.

    For more information, visit www.eset.com/za or follow us on LinkedIn, Facebook and Instagram.

    • This promoted content was paid for by the party concerned


    ESET Steve Flynn
    Subscribe to TechCentral Subscribe to TechCentral
    Share. Facebook Twitter LinkedIn WhatsApp Telegram Email Copy Link
    Previous ArticleManagement shake-up at TymeBank – including a new CEO
    Next Article Fortinet’s FortiNDR accelerates threat detection with advanced AI

    Related Posts

    TCS+ | From gen AI to deepfakes – the latest infosec threats

    1 October 2024

    TCS+ | ESET’s Adrian Stanford: how AI will transform cybersecurity

    10 June 2024

    AI’s double-edged sword requires a human security approach

    4 June 2024
    Add A Comment

    Comments are closed.

    Company News

    SAPHILA 2025 – transcending with purpose, connection and AI-powered vision

    13 June 2025

    Building a cyber-resilient culture from the boardroom to the front lines

    12 June 2025

    How South Africa’s municipalities are finally getting smart

    12 June 2025
    Opinion

    Beyond the box: why IT distribution depends on real partnerships

    2 June 2025

    South Africa’s next crisis? Being offline in an AI-driven world

    2 June 2025

    Digital giants boost South African news media – and get blamed for it

    29 May 2025

    Subscribe to Updates

    Get the best South African technology news and analysis delivered to your e-mail inbox every morning.

    © 2009 - 2025 NewsCentral Media

    Type above and press Enter to search. Press Esc to cancel.