Hosts:Justin Shelley — Phoenix IT Advisors | https://www.phoenixitadvisors.com/Mario Zaki — Mazteck IT | https://www.mazteck.com/Bryan Lachapelle — B4 Networks | https://www.b4networks.ca/What does it take to lose $50,000 in a single email? Not much. A spoofed address. A busy CFO. A wire transfer that clears before anyone realizes what happened.In Episode 80 of UnHacked, Justin Shelley, Mario Zaki, and Bryan Lachapelle dig deep into one of the most financially devastating threats facing businesses today: Business Email Compromise (BEC). This is Episode 6 of their ongoing 12-part series on Security Basics, and this one hits close to home for every business owner who relies on email to run their company — which is all of them.The guys break down exactly how BEC attacks work in two primary forms: lookalike domains designed to trick you letter by letter, and fully compromised email inboxes where a hacker is literally sitting inside your vendor's or employee's account, reading everything and waiting for the right moment to strike. Using AI, attackers can now download entire mailboxes, study communication patterns, and pick up mid-conversation with chilling accuracy.But the scariest part of this episode isn't the technology — it's the human element. From new employees targeted on LinkedIn within days of posting about their new job, to companies that actively silenced their own IT teams who flagged security gaps (and paid dearly for it), the hosts make a compelling case that people — not software — are both the biggest vulnerability and the most powerful defense a company has.You'll learn:The two types of Business Email Compromise and why one is nearly impossible to stop with technology aloneThe one phone call that could have saved a $50,000 wire transfer — and why most companies don't make itWhy punishing employees who report mistakes is one of the most dangerous things a company can doHow attackers use LinkedIn to target new hires and exploit their eagerness to impress leadershipWhat "zero trust" really means in the context of email — and how to build it into your team's daily behaviorHow to report lookalike domains and get them taken downWhy a culture of security awareness is more valuable than any software tool you can buyThis episode is a wake-up call. Email is not safe by default. Your vendors can be compromised. Your new hires are being targeted. And if you don't have written policies and a culture that rewards vigilance, no firewall in the world will save you.

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related