Finning International Stops Email Fraud, Restores User Trust by Building on Proofpoint Investment

The company had already deployed email defences to stop malware, unsafe URLs and phishing attacks. But attackers were shifting tactics. Instead of just trying to exploit vulnerabilities in Finning’s infrastructure, they were now targeting its people. Employees began receiving emails impersonating vendors, customers and even coworkers.

In one situation, a Finning executive got an email instructing him to wire a large sum of money to the sender—someone impersonating the CFO. The attacker had registered the domain “fjinnjng.com,” which in many email clients looks like “finning.com.” Fortunately, the executive was able to identify the phishing email and immediately reported it to the security team as per company protocol.

Lookalike email domains like this are just one of the techniques used in so-called business email compromise (BEC) attacks. In BEC, attackers use email to pose as someone the recipient trusts, including colleagues, business partners, suppliers and customers. The sender might send a fake invoice, ask for a wire transfer or instruct the recipient to change banking details to divert payments.

Losses due to BEC and a closely related attack known as email account compromise (EAC) have reached $26 billion worldwide, according to the FBI. 1 (In EAC, attackers take over a legitimate email account to impersonate that person.)

Fortunately, Finning had invested in Proofpoint Security Awareness Training, so the executive knew to double-check the request. His training kicked in and stopped what would have been a costly mistake.

But as the volume of fraudulent email grew, the risk was getting harder to manage. Following up on suspicious email reports was turning into an operational nightmare for the security team. Normal transactions were getting held up in a cloud of doubt. In short, one of Finning’s most essential business tools—email—was becoming a business liability.

“When people can’t tell right (emails) from wrong, there’s a fundamental issue,” Uhreen said.

So far, the company’s employees had done a good job “catching live grenades,” as Uhreen puts it. But the approach wasn’t scaling. What Finning really needed was a way to lob those grenades away before they reached users’ inbox.

Unlike malware attacks, BEC and EAC attacks rely on social engineering, not technical vulnerabilities. There’s no payload to scan, making them much harder to detect—nearly impossible with conventional security tools.