Email fraud, also known as business email compromise (BEC), is one of today’s greatest cyber threats facing organizations. These socially engineered attacks seek to exploit people rather than technology. They are highly targeted, don’t include attachments or URLs, arrive in low volumes, and impersonate people in authority. These and other factors make email fraud difficult to detect and stop with traditional security tools.
Email fraud preys on human nature—fear, the desire to please, and more– to steal money and valuable information from employees, customers, and business partners.
Proofpoint analysed 168 domains belonging to some of the largest Dutch companies and checked their stage of implementation of DMARC (Domain-based Message Authentication,
Reporting & Conformance). DMARC is a recognised email authentication protocol which was recommended by the Dutch government early on and the only way to block domain spoofing before it reaches its targets.
The good news is that the Netherlands is leading the way when it comes to DMARC adoption. That said, there is still a significant number of large companies and best-known Dutch brands exposed to email fraud:
- 75% of the top Dutch companies had no DMARC record published, meaning they have no visibility into email threats using their own domain(s), also known as domain spoofing attacks. These types of attacks are favoured by cybercriminals as they look like they are coming from legitimate domains. Based on our most recent threat research, 93% of companies were hit by domain spoofing attacks in Q4 17.
- Of the 25% that had started on their DMARC journey, only 6% were fully implemented, meaning they were proactively blocking fraudulent emails abusing their domain before they reached the inbox.
- Now looking across the Dutch companies listed on the Forbes 2000, 13 companies out of 21 have published a DMARC record (60%), which makes sense as large companies tend to lead the way in technology adoption. However, this still means that 40% or 2 in 5 have no visibility into email threats targeting their enterprise.
- Finally, we also analysed the top 20 Dutch companies in the Elsevier 500, and the DMARC adoption rate is 50%, which is commendable considering the size of organisations we are talking about here. Still, half of them haven’t started on their journey to protect themselves against email fraud.
The larger the organisation the more serious they seem to be taking email fraud protection. And while great progress has been made, all research points to the fact that cybercriminals target companies of all sizes.
How You Can Prevent Email Fraud
While implementing DMARC is a great first step, email fraud attacks are constantly evolving. Cybercriminals leverage various spoofing techniques in an effort to reach the intended target and trick them into acting on their behalf. These include domain spoofing, addressed above, but also include display name spoofing and lookalike domain spoofing techniques as well. Organizations need a multi-layered solution to stop all forms of email fraud including dynamic classification, email authentication, lookalike domain discovery, and data loss prevention.
To read our complete email fraud analysis and learn more about how you can stop attacks at your organization, download the 2017 Email Fraud Threat Report.