How the finance industry is getting ripped off by fake emails
Business email compromise (BEC) and phishing attacks are a major issue for companies in financial services, banking, and insurance.
These email-borne attacks expose finance enterprises to legal and financial liability and reputational damage, as well as cybersecurity risks including network compromise and digital asset exfiltration.
The attacks are not merely inbound, either.
Valimail observed more than 2.5 million attempts to impersonate financial companies via fake email messages over the course of one month. These are fake emails impersonating financial companies, sent from a malicious source to recipients that may include the spoofed companies’ employees, but also include recipients outside the company: customers, partners, and the general public.
That’s just one of the findings in Valimail’s latest research report, Stopping Email Fraud in Finance and Insurance.
The Problem of Fake Identity
The majority of BEC attacks use faked sender identities, posing as trusted financial institutions, often using those organization’s actual domain names in the From: field of their messages. In many cases those attacks target outside entities (customers, partners, or members of the public), not the companies themselves.
We found that the leading source of fake email impersonating finance and insurance companies is the United States, followed by Russia, Vietnam, and Indonesia.
DMARC Usage Rates in Finance
While there are widely-accepted open standards to authenticate email and prevent phishers from spoofing sender domains, a majority of companies in most industries have not made full use of these standards. Valimail’s research shows that the global finance industry is no exception.
Among the world’s largest banking, financial services, and insurance companies, just 8% have deployed email authentication using DMARC with enforcement in order to protect themselves from being spoofed by phishing emails.
Another 34% have begun the journey to authentication by deploying DMARC in monitoring mode, which allows them to collect data on the email services using their domain, but have not yet configured it to block impersonation.
DMARC Usage by Country and Revenue
Additionally, Valimail’s report found that finance companies with DMARC records have larger annual revenues ($7.27 billion), on average, than those without DMARC ($4.69 billion).
Australia, India, and Mexico have the highest rates of DMARC usage among finance companies. At the other end of the scale, countries whose finance companies have rates of DMARC usage well below the global average are Switzerland, Germany, and China.
The full report includes many other stats on the vulnerability of financial institutions to fake email and email-based fraud.
This 8-page report is the latest in a series of research papers published by Valimail, all based on our unmatched knowledge of the email ecosystem, our industry-leading real-time analysis of tens of millions of DNS records, and aggregate data from billions of email authentications performed on behalf of our customers.
Download the complete financial industry report here.