Anatomy of a BEC Attack: What AI Can Detect That Humans Might Miss

The upcoming challenge with email security today is that attackers are increasingly leaning into social engineering scams, rather than the malware-ridden emails we all know and love. And know how to catch. 

These newer, human-targeted attacks are precisely the types of ploys traditional tools - not to mention our own eyes - are likely to miss. It’s no wonder things like QR-code phishing, call-back scams, and BEC attacks are relentlessly on the rise.

And AI just makes it easier.

Companies that invested heavily in the email security solutions of yesterday (i.e., two years ago) are quickly being outpaced by agile attackers with newer, more agile techniques. 

We have come to the place, at least in email security, where the only way to catch these (largely) AI-crafted social engineering scams is with AI-powered capabilities of our own. The language is too accurate, the styles are too similar, and the deceptions too believable otherwise.

And the Business Email Compromise (BEC) battle stats agree. 

Today’s Uncatchable BEC Scams

BEC scams cost billions. According to data from the FBI, they caused over $2.9 billion in adjusted losses in 2023; 48 times higher than those incurred by ransomware. 

The problem is not an unfamiliar one. Email security tools have become highly attuned to catching malware via its signatures, even its malicious behaviour. This allows filters to spot even advanced malware-driven email exploits. But they can’t catch what’s not there.

BEC scams work by duping employees with urgent messages requesting wire transfers, invoice adjustments, and other forms of immediate payment. No malware is required or included. Based on the believability of the BEC email alone, users gave millions (even billions) over to attackers, while advanced email security solutions stood by and did nothing. There was nothing they could do. 

The answer? Improved user training, yes. But even that is falling short in the face of AI-crafted emails designed to impersonate the very writing styles of employees (not to mention increasingly convincing spoofed sites and high-pressure tactics).

The real solution lies in a thorough, step-by-step workflow in which minor details of incoming emails are evaluated, analysed, and investigated for BEC potential.

But by hand, that can take a very long time.

What It Takes to Catch a BEC Scam Successfully

There is a highly involved process behind every quarantined BEC email. The problem is that many SOCs lack the expertise, the people power, or the cycles to get it done; all the way, every time. And that’s where attackers sneak in. 

Let’s take a look at what it is. 

1. Observe an Anomaly: These can be reported by users (“I don’t know this sender,” “This looks phishy”) or caught by a detection system that flags odd behavior; the creation of new mailbox rules, legacy authentication, etc.

Look at the details. Examine the full received section (for hop-by-hop routing), DMARC and DKIM results, X-headers, and MIME boundaries for things amiss.

2. Corroborate with Behavioral Cues: As Prophet Security, a leading AI SOC company, states, “Once you suspect a BEC attack, it is critical to analyze behavioral telemetry and authentication logs to confirm account compromise or malicious activity.” 

This means:

• Checking MFA settings for bypass events
• Looking for suspicious login activity (unusual locations or timeframes)
• Searching for mailbox rule alterations (like deleting emails with “invoice” and suppressing alerts)
• Identifying third-party mailbox access in consent logs

And more.

3. Look for Gaps in Business Workflows: For example, did the request advocate subverting the usual verification process for new vendors? Did it circumvent the traditional invoice approval timeline? Did it follow established procedures? If not, you’ve got a smoking gun.

While these are the basics for determining BEC guilt in the first place, once an attack has been discovered, the real work begins. The process of investigating lateral and collateral damage, mitigating impact, containing the threat, and getting processes back to normal is, again, a strain on SOC resources and time.

Better to catch it before it strikes. And yet, given the detailed nature of the process (as merely outlined above), it is easy to see how SOCs could struggle to complete it. Not to mention, complete it with accuracy and at scale. 

And this is where an AI SOC comes in. 

How AI SOCs Catch BEC Better Than Humans

AI SOCs are modern Security Operations Centres that combine hyperautomation with advanced AI to do more, see farther, and optimise threat detection and response for their human counterparts.

That’s good, because in the vast process of detecting and determining BEC scam validity, there are a lot of things human eyes and manual processes can miss. 

The rate at which attackers can create and disseminate BEC and other phishing scams far exceeds the abilities of most SOCs to investigate, thanks to AI. And that’s not the only thing SOCs have on their plates; according to some industry reports, organisations are struggling with as many as 10,000 alerts per day. In the mix of all that, it’s highly likely that some BEC clues are going to get left behind. 

AI SOCs are designed to do all the investigative work of real, human-staffed SOCs, but with higher accuracy and at scale. Using Agentic AI, they reduce alert fatigue and burnout, as they can not only assess information but also autonomously make decisions without constant human oversight. 

That means all the work of validating sender identity, vetting DMARC authentication, checking for rule tampering, and finding gaps in approved workflows can be automated and done at scale.

• Automate L1 and L2 Investigations: AI SOCs can autonomously gather data, correlate it, investigate leads and decide what to ignore, and draw intelligent conclusions that puts human analysts ahead of the game.
  
  
• Get Rid of Time-Consuming Operations: So much of BEC threat investigation is switching between tools, pulling data out of reports and logs, and enriching alerts. Then, the investigation can really begin. AI SOCs can do all this automatically. 
  
  
• Get Better with Infallible Memory: Even when humans do the day-to-day tasks of hunting down BEC scams, they can still forget what they’ve seen and be less prepared for next time. AI SOCs never forget, using ML to learn from successful investigations, log data, and get better as they go.