Business email compromise and CEO impersonation is on the rise, and it puts the entire organization at risk…

One of the most successful cyber-attacks of 2022 is CEO fraud, also known as Business Email Compromise (BEC). According to the FBI’s Internet Crime Complaint Center 2021 report,  this type of attack is one of the most profitable, and one that has seen a significant increase. It is also incredibly smart – cybercriminals impersonate the CEO or a high-level executive using email, deep fakes or audio files to trick staff into providing access to critical business information, systems or even authorizing fraudulent payment transactions. It is, says Anna Collard, SVP Content Strategy & Evangelist at KnowBe4 AFRICA, pervasive and smart, and it asks that companies pay very close attention to security protocols that are designed to mitigate this threat.

“This type of fraud is one of the most prolific at the moment, probably because it has been so successful,” she explains. “Essentially, the cybercriminals either spoof or compromise the CEO/ executive’s email and then use this to send instructions to key employees. Sometimes they even combine these messages with voice notes using deepfake audio to mimic the executive’s voice, and instruct employees to transfer money or provide password information or give them access to certain systems. The fake CEO is so convincing that employees do exactly as they are told.”

BEC is usually financially motivated. The hackers use the world’s reliance on hybrid and remote working, and virtual meetings, to make millions. According to the FBI, the price tag attached to BEC scams exceeded $43 billion in 2022  and that these types of attacks now make up 35% of all cybercrime losses. Their success rate is high because the attack vector works purely on social engineering a human and without the use of any malicious software. Attackers play the long game when it comes to penetrating the systems and gaining access to the CEO’s emails.

“It usually starts out with a phishing campaign,” says Collard. “Users in the company are targeted with phishing emails that ask them to enter information into very realistic-looking websites. These emails are designed to lure employees in so that they accidentally hand over their account details to the cybercriminals. Once the latter have those, they enter into the company system, and attempt to compromise the CEO or other people at the executive level, such as the Chief Finance Officer (CFO). Once there, they can build compelling BEC scams sending emails directly from the compromised accounts.”

Once the hackers have access to the CEO’s email system, the chances of them succeeding at siphoning millions from the organisation go up exponentially. And the sums of money that they are stealing are eyewatering, especially considering their target markets. The FBI report found that banks were the most common targets, especially those located in Thailand, Hong Kong, Mexico and Singapore. According to a recent Trend Micro report, respondents believe that the top cyberthreat of 2022 was BEC and that they saw an increase of successful cyber-attacks from 84% to 90%.

“The problem is, this type of attack is so easy to perpetrate once you have all the right information,” says Collard. “Who can argue with the CEO if they are messaging you and asking you to make an urgent payment because they are busy boarding a plane? Or with an email that asks you to pay a supplier urgently? People get nervous and try and do the right thing – they want to impress the boss. That is why this attack is so effective. Who would say no to the CEO?”

Overcoming the threat requires both financial controls such as segregation of duty so that no single person is responsible for every stage in the payment process as well as awareness training. This involves constant reminders and awareness training across every level of the company that underscores the insidious nature of social engineering and the risks of BEC.

“Training and awareness are absolutely the best line of defence against the BEC attack,” concludes Collard. “This can potentially stop the initial phishing attempt that exposes the CEO’s information in its tracks, and, if that fails, it can even prevent the payment from taking place because the employee is asking the right questions instead of racing to do what they are being told. If people are aware of how these scams are perpetrated, they can make informed decisions that can save the company millions.”

While many countries slowly ease the lockdown measures that were implemented because of the Coronavirus pandemic, the interest to domestic and international travel starts to increase. Kaspersky throws a light on some travel patterns of parents and their children on the go.

According to the “Responsible Digital Parenting” survey¹, 89% of the parents in Nigeria use their gadgets to entertain their child when they travel. Furthermore, 33% of the respondents try to calm down their children with the help of devices and 22% aim to gain some spare time for themselves. As a result, there is a chance that children are often left one-on-one with the gadgets. What is more, 56% of Nigerian children have their own smartphone or tablet, according to the survey. Among such a big number, the majority of children were 2-6 years old when they first got their own device. Nevertheless, 31% of Nigerian parents have not discussed safety rules on the Internet with their child. It means that the children are not always aware of how to behave themselves safely online.

Also Read: Digital misunderstanding: 55% of Nigerian parents have conflicts with their children because they spend too much time on the phone.

“Most parents give their children gadgets in order to entertain them, spare some time for themselves or calm down their kids. However, they shouldn’t use digital devices uncontrolled. It has been estimated by Kaspersky that 19% of Nigerian parents would like to monitor their child’s digital life better. This can be done by limiting screen time and holding conversations; however, a security solution is needed as well,” states Andrey Sidenko, Head of Child Safety at Kaspersky Network.

In order to teach children to use their gadgets in a beneficial way, to safeguard them from inappropriate content, take the following advice:

1. Explain to your child the ethics of the Internet (not to write anything offending or insulting, not to post embarrassing, indecent photos, etc.) and safety rules on the Internet (not to respond to strangers, not to publish too much private information etc.).
2. Communicate with your child. Discover his or her interests and suggest suitable materials and video bloggers. Ensure them that you are a modern parent who understands them and to whom they can always come for a piece of advice.
3. Install a reliable security solution such as  to monitor your child’s activity successfully.

The worldwide COVID-19 pandemic has forced families to spend their free time mostly at home. Staying at home usually also means spending much time using different Internet-connected devices. For clear reasons, children’s growing online activity can cause lots of worries for their parents.

Thus, according to a Kaspersky (www.Kaspersky.co.za) survey¹, 25% of Nigerian parents claim that they have come across something in their child’s social media account that seemed suspicious. Elaborating on what it exactly was, they mention groups or public pages they join (56%), posts that they publish or share (50%), people they interact with (31%), video on their page (31%) and private messages (19%).

Also Read: 40% of Parents in Nigeria agree that Cute Photos with Kids get more likes

What is more, 34% state their child has seen or listened to something that seemed suspicious to them, be that videos (68%), music (43%), or photos (25%). Obviously, this data shows the need to explore the interests of children, to make sure everything is okay or if it is necessary to take action. However, not all the parents realize it – only 19% of them befriend their children via social networks in order to be connected with their kids – sometimes real communication is not enough and the parents have to look carefully at their children’s webpages.

“It gets harder and harder for parents to keep up with the pace of the modern evolving world. They are often left out of the picture as they simply do not catch up with trends that emerge way too fast. However, it is possible to stop this backlog by communicating with your child and ensuring your presence on the Internet – to build trust and a good relationship with your child you have to know what you are talking about with them,” states Maher Yamout, Senior Security Researcher at Kaspersky.

In order to eliminate groundless suspicions about your child’s digital life and to secure their presence on social media, Kaspersky strongly recommends following this advice:

1. Learn more on the topic of children’s cybersecurity: explore modern trends, apps, the way of behavior that has to be adopted in order to safeguard against dangers (for instance, the basic security rules while on the Internet);
2. Communicate with your child and define the boundaries which are not meant to be crossed: discuss with them safe locations both real and webpages;
3. Install a reliable security solution to monitor your child’s activity successfully.