A new investigative report from security solutions provider Agari revealed the geographic locations of business email compromise (BEC) cybercriminals. The investigation found that email fraudsters are operating globally across 50 countries with 25% of scammers in the U.S. In a BEC attack, cybercriminals first steal legitimate business email account credentials, which are later used to launch financial fraud campaigns like fraudulent email messages, requests for out-of-channel funds transfers, and deleted accounting trails.
Agari stated that its Cyber Intelligence Division (CID) identified money mule networks of cybercriminals in every state, including the District of Columbia. Hackers use money mule networks to launder and quickly move money offshore.
Key Findings:
- Over 2,900 global money mule bank accounts were uncovered, with more than 900 identified money mules located in the U.S.
- BEC cybercriminals demanded $64 million illicit funds in total.
- An average of $247,000 of payments were requested to Hong Kong money mule accounts, six times higher than in the U.S.
- BEC cybercriminals are located across 50 countries where 50% of email fraudsters located in Nigeria and 25% located in the U.S.
- Nearly 48% of U.S.-based email scammers are located in five states: California, Georgia, Florida, Texas, and New York.
- The five cities with the biggest volume of clusters of email scammers include Atlanta, GA, New York, NY, Los Angeles, CA, Houston, TX, and Miami, FL.
Agari Chief Identity Officer Armen Najarian, said, “A CISO I spoke to just last week explained her number-one goal is customer trust – to earn it, maintain it, and respect it. The information unveiled today as a result of our ACID team’s investigations enables CISOs to learn something new about the threat landscape they are working in and how to adapt their security controls to stay ahead of fraudsters. And ultimately those actions taken by the CISO organization earn and sustain consumer trust.”
BEC Attacks – A Remunerative Business for Cybercriminals
A similar research from the APWG (Anti-Phishing Working Group) revealed how enterprises lose their wealth to BEC attacks. In its “Phishing Activity Trends Report,” APWG highlighted that the average wire transfer loss from BEC attacks surged from $54,000 in Q1 2020 to $80,183 in Q2 2020, as cybercriminals expected high returns. Read the full story here.
