HB-05Level 4 · Breach scenarioFBI IC3: BEC · VERIS: Social, pretexting
BEC & payment fraud
- Level 4 · Breach scenario
- 11 signals
- 5 risk domains
A loss in which an impersonation or pretext leads a person with payment authority to send money or change payee details.
Classification
- Fed by risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Anchor
-
- FBI IC3: BEC · VERIS: Social, pretexting
- NIST CSF 2.0
-
- PR.AT-02
- PR.AA-05
- MITRE ATT&CK
-
- T1684.001
- T1684.002
- T1114.003
- T1657
-
1
Sequence
End in this breach scenario.
-
1
Cohort
Predict it.
-
11
Signals
Feed it.
-
5
Risk domains
Where those signals come from.
Sequences that lead here
One sequence ends here.
Each one is a set of signals in order inside a window. Watch it play.
SQ-FR-014 stepsPeak: Stage 4 Suspected
Approver under attack
Step 01ATT&CK tactic: Initial Access
Impersonation delivered
SE-T-03Receives impersonation attempts
Stage 1Exposed
Step 02ATT&CK tactic: Execution
Replied to sender
SE-B-09Replies to or engages with suspicious senders
Stage 3Exploited
Step 03ATT&CK tactic: Collection
Forwarding rule created
DH-B-06Forwards work email to personal accounts
Stage 4Suspected
Step 04ATT&CK tactic: Impact
Payee change approved
SE-A-02Holds payment approval authority
Stage 4Suspected
Approver under attack, 4 steps inside 14 days: Impersonation delivered (SE-T-03 Receives impersonation attempts, Initial Access, Stage 1 Exposed); then Replied to sender (SE-B-09 Replies to or engages with suspicious senders, Execution, Stage 3 Exploited); then Forwarding rule created (DH-B-06 Forwards work email to personal accounts, Collection, Stage 4 Suspected); then Payee change approved (SE-A-02 Holds payment approval authority, Impact, Stage 4 Suspected). It leads to HB-05 BEC & payment fraud.
-
SQ-FR-01
Approver under attack
- Step 1: Impersonation delivered (SE-T-03 Receives impersonation attempts)
- Step 2: Replied to sender (SE-B-09 Replies to or engages with suspicious senders)
- Step 3: Forwarding rule created (DH-B-06 Forwards work email to personal accounts)
- Step 4: Payee change approved (SE-A-02 Holds payment approval authority)
- Breach scenario: HB-05 BEC & payment fraud
The definition, in detail
Definition
It is the Business Email Compromise category in the FBI IC3 Internet Crime Report and the pretexting variety of the Social action in VERIS.
Example
A spoofed executive asks the controller to approve new bank details for a supplier, and the next payment run sends the money to the attacker.
How it is measured
- Anchor
- FBI IC3: BEC · VERIS: Social, pretexting
- SOC signals
- Fraud attempts, mailbox rules
- Fed by
- 11 signals across 5 risk domains
How it is used
Programs measure toward BEC & payment fraud by counting the 11 signals, 1 cohort and 1 sequence that point to it, and tie them to the incidents the SOC records as fraud attempts, mailbox rules.
A breach scenario names what the evidence beneath it points toward. The organization’s own incidents confirm it; the signals, cohorts and sequences show where it is likely.
Technical mappings
Framework mappings; validate for your use case.
Continue exploring
"BEC & payment fraud" (HB-05), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/breach-scenarios/hb-05-bec-and-payment-fraud
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one breach scenario.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.