Walk-Through of Business Email Compromise: Human Factors or Human Failures?
summary
Company email gets phished, credentials stolen, and within 24 hours criminals register a fake domain registration and scan inboxes for old invoices; they set email filters hiding confirmations to intercept verification requests, coordinate dual narratives to both buyer and supplier, and trigger a bank reversal that is then redirected to a Netherlands account. The buyer freezes and recovers the funds after about a week, police and banks assist, and recommended fixes are out‑of‑band verification, targeted training, and rolling out multifactor authentication.
AI-written summary · about
chapters (21)
- 0:00Business email compromise intro
- 1:04Why BEC matters
- 3:55BEC scam timeline
- 4:17Normal ABAX supplier comms
- 6:03Phishing at ABAX
- 7:30Criminals setting up the scam
- 9:19Faking communication both ways
- 10:46Bank red flags
- 12:13Supplier confirms fraud
- 14:00Pressure after reversal
- 16:29Supplier realizes fraud
- 17:38Funds recovery
- 18:23Police investigation
- 20:10Key ABAX lessons
- 21:36Fraud detection language
- 22:41Stress vs automation
- 23:46Policy review
- 24:26Out-of-band verification
- 25:33Employee training
- 26:17MFA improvements
- 27:01Q&A
related talks
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait
55mHacking Humans
26mDon't Blame the User! Stop the Phish Before it is Even Sent
40mUnder the Unfluence: the Dark Side of Influence
26mIntegrating Identity and Fraud
25mHacking the human mind: The rise of social engineering security threat
48mHow to Rob a Bank over the Phone - Lessons Learned from an Actual Social Engineering Engagement
30mProfessionals hack people, not systems