Something happened at our software company yesterday. Our accountant got an email from someone claiming to be our boss, asking for an urgent transfer. They were about to send it, but got suspicious after a few questions.
Thank god they didn't fall for it, but then the boss asked 'could I have sent that?' No one is sure. Should we set up a system in the business against these kinds of attacks?
I'm curious how other SMEs handle this.
Doki · Infrastructure migration · 2024
This attack is known as 'Business Email Compromise' (BEC). Fake accountant emails target finance staff.
Solution: Create a written protocol for all transfers. Require approval from at least 2 people. Verify via phone or in person, not via email.
Be suspicious if the email contains words like 'urgent' and 'confidential'. Attackers try to create a sense of urgency.
we experienced the same thing.. but anyway accounting was really nervous. then we made a written protocol with the boss. now were more relaxed
Transfer protocol: 1. When an email is received, verify the sender by calling them 2. Details of the transfer: amount, account, description 3. Approval by a second person 4. Then process the transaction 5. Document it
Set up 'External Email' tagging in your email system — it should highlight emails from external sources. It makes it harder for attackers to mimic internal messages.
BEC attack explained: Fake boss email urgency, transfer instruction + bank details. If the accountant doesn't double-check, there's damage.
edit: typed from phone, sorry for typos.
There's one point I'm curious about. The harder it is to reverse a decision, the slower you should make it.
If you have questions, write them; I'll answer as best I can.
Let me share what happened to me; it might be useful. If you get three different answers on a topic, the question was asked wrong.
thanks for posting. btw trying to do this alone is the most expnsive way.
i'm also curious if anyone does it differently.
Do you think this works at any scale? The harder it is to reverse a decision the slower you should make it.
Hasty decisions become decisions you have to fix six months later.
Quick summary for newcomers: If permission and scope aren't in writing, don't start that test.
If you don't write this down from the start, it leads to arguments later. If you post the result here, it will help others too.
I think it's hard to be that definitive about email asking for money from accounting. An automated scan report is not the same as a penetration test.
The real issue isn't the number, but what it's based on.
Let me share my experience. Most time waste accumulates in tasks waiting for approval.
An untested backup is not a backup. If you post the result here, it will help others too.
There are three things to check when doing this. Your time to detect an issue directly determines its cost.
Hope this helps.
Same here. Security isn't absolute; it's about making attacks not worth the effort.
That's all, sorry if I went on too long.
I agree with this. An automated scan report is not the same as a penetration test.
Just because everyone does it doesn't mean it's right. If I were you, I'd go this route.
Great work. If you scold false alarms, nobody will report again.
Don't hesitate to ask; those who don't ask always pay more. If I were you, I'd go this route.
I partly agree, partly disagree. Hasty decisions become decisions you have to fix six months later.
Of course, it varies if your situation is different.