Gift Cards: A New Business Email Compromise

Employees should always watch out for any emails requesting a financial transaction or asking them to open an attachment or click a link. But the holiday season brings a seasonal twist to business email compromise (BEC) attacks that happen year-round, says Asaf Cidon, vice president of email security at Barracuda Networks. Gift lures are common around the holidays.

"I think the gift card attack is quite interesting because, in a sense, it is a blend of two disparate attacks we've seen in the past that have now been combined," he explains. The first of these is CEO fraud, in which an attacker impersonates the CEO to request a financial transaction from a junior employee. Second is the gift lure, which is common around the holidays.

"As far as we can tell, up until this holiday season, we've never seen this specific blend of attack," Cidon continues. "It seems that attackers are getting inspiration from different types of successful attacks and trying to blend different tactics to achieve their aims."

These aims, he adds, are primarily financial in nature – getting a victim to wire money, for example, or pay for a liquid asset (gift cards, Bitcoin) that the attacker can monetize. The greatest threat from email and communication fraud is account takeover. Cidon says his company is seeing more attackers compromise employee accounts so they can trick colleagues and third parties. It's most devastating when it abuses the legitimate account of a high-level employee.

If you receive a request to send a gift card or a link to open one, be sure to verify the sender's address and ensure the email doesn't come with suspicious links or strange address, he advises.