Phishing and BEC Attacks Bypass Code Defenses by Targeting Employees

Attackers can defeat strong technical security by manipulating staff rather than systems, using impersonation and urgency to trick people into acting. Business Email Compromise is a targeted form of this, where criminals study a company's payment workflows and pose as executives or suppliers to request wire transfers or bank detail changes. The FBI's Internet Crime Complaint Center reported more than $50 billion in exposed losses from BEC between late 2013 and the end of 2022. The article argues that the main defenses are procedural rather than technical, including verifying requests through independently known contact numbers, enabling multi-factor authentication, requiring dual approval for payments, and configuring SPF, DKIM, and DMARC email authentication.