⚠ Simulation Only: All names, companies, and financial details are fictional. For educational purposes only.
🐋 Critical CEO Fraud / BEC

Whaling & Business Email Compromise

Whaling targets senior executives. Business Email Compromise (BEC) is a broader attack where criminals impersonate CEOs, CFOs, or vendors to authorise fraudulent wire transfers. It's the most costly form of cybercrime.

$2.9B BEC Losses in 2023 (FBI IC3)
21,489 BEC Complaints Filed in 2023
$137K Average Loss per BEC Incident
#1 Costliest Cybercrime Category
1
The Bait
2
The Reveal
3
The Defence

🎣 Phase 1 — The Bait

You are Sarah Kim, Finance Manager at GlobalEdge Inc. The CEO is at an investor conference in Singapore. You just received this email.

🔍 Phase 2 — The Reveal

This is a BEC attack. The real CEO's email was never compromised — the attacker simply registered a lookalike domain. Here are the red flags.

🚩
1. Domain Substitution — .co vs .com
The email came from globaledge-inc.co not globaledge-inc.com. One character difference. The attacker registered this $1 domain specifically for this attack. The CEO's real address ends in .com.
🚩
2. Secrecy Request — "Don't Tell Anyone"
"Keep this strictly confidential… don't mention it to anyone in the office." This is designed to prevent Sarah from consulting colleagues who would immediately spot the fraud. Legitimate financial requests always go through proper internal approval chains.
🚩
3. Extreme Time Pressure
"Must be completed by 3 PM SGT" — the manufactured deadline prevents proper due diligence. In BEC attacks, time pressure combined with the CEO's authority is the most powerful manipulation vector.
🚩
4. Out-of-Band Financial Request
Legitimate wire transfers at any company require formal purchase orders, multiple approvals, and CFO sign-off — never an email from the CEO alone. Any one-off, urgent wire request via email should trigger immediate verification.
🚩
5. Exploiting the Executive's Travel
Attackers monitor LinkedIn, press releases, and conference schedules to know when executives are travelling. Being "in Singapore" explains why you can't easily reach him — and makes it plausible he's on mobile.
🚩
6. "Sent from iPhone" Excuse
This excuses any writing style inconsistency and reduces the sender's accountability for details. It's a common BEC convention to explain away oddities in the email.

🛡️ Phase 3 — Defending Against Whaling / BEC

  • Implement a dual-authorisation policy for all wire transfers above a threshold — no single email approval, ever.
  • Always call back to verify unusual wire requests using a pre-known number (not one in the email). Even 60 seconds on the phone stops BEC.
  • Check the sender's email domain character-by-character for substitutions (.co vs .com, missing letters).
  • Create a culture where employees feel safe to question and delay urgent financial requests — even from the CEO.
  • Configure email security to flag external emails that spoof internal domains or display executive names.
  • Add a visible banner to all external emails: "This email originated outside the organisation" — a simple but highly effective control.
  • Brief finance, HR, and admin staff specifically on BEC — they are the primary targets.
  • Report suspected BEC to the FBI's IC3 (ic3.gov) immediately — funds can sometimes be recalled if reported fast enough.

BEC Attack Variants

👔 CEO Fraud
CEO impersonated to authorise wire transfers to finance or HR
📦 Vendor Impersonation
Attacker pretends to be a supplier and changes bank account details for invoices
🧾 Invoice Fraud
Fake invoices sent to Accounts Payable from spoofed vendor domains
🏦 Payroll Diversion
Attacker contacts HR impersonating an employee to redirect salary payments