How BEC Attacks Work

• Impersonation:

  Attackers impersonate legitimate law firms, attorneys, or clients to gain trust and encourage recipients to take action. 
• Email Spoofing:

  They use email spoofing to make emails appear to come from a legitimate source, even though they are not. 
• Spear Phishing:

  BEC attacks often involve spear phishing, where emails are carefully crafted to target specific individuals or departments within a law firm. 
• Financial Requests:

  Attackers may request urgent payments, wire transfers, or other financial actions, often using fabricated invoices or requests. 
• Information Gathering:

  They may also try to obtain sensitive information, such as client details, financial records, or other confidential data. 
• Malware:

  In some cases, attackers use malware to infiltrate company networks and gain access to legitimate email threads and information. 

Examples of BEC Scenarios

• Fake Invoices:

  Attackers might send fake invoices or payment requests to clients, convincing them to send money to a fraudulent account.
• Impersonated Attorneys:

  They may impersonate attorneys, asking for urgent actions or information, like changing bank account details.
• Impersonated Clients:

  Attackers can impersonate clients, requesting that a payment be made to a different account. 

How to Protect Against BEC Attacks:

• Employee Training:

  Educate employees about BEC scams and how to identify suspicious emails. 
• Strong Passwords and MFA:

  Implement strong passwords and multi-factor authentication (MFA) to protect email accounts. 
• Verify Emails:

  Always verify email requests, especially those involving financial transactions, by contacting the sender directly through a known phone number or other trusted method. 
• Email Filtering:

  Use advanced email filtering techniques and AI/ML for anomaly detection to identify and block suspicious emails. 
• Monitor Email Activity:

  Regularly monitor email activity for unusual patterns or suspicious behavior. 
• Report Suspicious Activity:

  Report any suspected BEC scams to the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. 

Why Law Firms are Targeted:

• High-Value Targets:

  Law firms often handle sensitive financial information and deal with high-value transactions, making them attractive targets for BEC attackers. 
• Publicly Available Information:

  Law firms often have publicly available information about their clients and employees, which can be used by attackers to personalize their scams. 
• Complex Communications:

  Legal matters often involve complex email chains and communications, which can be exploited by attackers.