How will the SVB collapse boost BEC scams and what can you do?

Whenever a crisis strikes in today’s digital world—whether a natural disaster or a financial shock—people flock to the Internet for help, updates, and ways to stay connected. That surge in online activity creates a perfect hunting ground for cybercriminals looking to exploit the chaos. Scammers target the flood of emails that contain critical information, hoping to intercept or spoof messages that appear legitimate. By inserting themselves into these urgent conversations, they increase their chances of success. This is why the recent bank failures have become a hotbed for Business Email Compromise (BEC) attacks.

When Silicon Valley Bank (SVB) and Signature Bank collapsed, businesses rushed to move funds, open new accounts, and update routing details. This frantic activity generates a massive volume of confirmation emails, account opening notices, and internal communications. Cybercriminals can easily masquerade as bank officials or trusted vendors, sending fraudulent requests for account details or wire transfers. The urgency and confusion surrounding these moves make recipients more likely to act without proper verification. As a result, the threat landscape for BEC attacks is set to expand dramatically.

What exactly are Business Email Compromise (BEC) attacks?

Business Email Compromise (BEC) is a type of phishing scam where attackers impersonate a trusted sender to trick victims into sending money or sensitive information. Over the past five years, the FBI has reported more than $43 billion in losses from BEC scams worldwide. These attacks often involve compromised executive accounts, fake invoices, or fake payroll requests. By hijacking a trusted relationship, attackers increase the likelihood that the victim will comply with the fraudulent request. The result is often large, unauthorized wire transfers that are difficult to recover.

• CFO compromise – attackers pose as the chief financial officer to approve payments.
• Executive compromise – impersonating CEOs or other senior leaders to request urgent transfers.
• Whaling – targeting high‑level executives with highly personalized phishing emails.
• Payroll scams – tricking HR or payroll departments into redirecting employee salaries.

These tactics prey on established trust and the expectation that important financial communications will come from known contacts. The chaos following a bank collapse amplifies this risk, as organizations scramble to update banking details under tight deadlines.

“While there are many forms of BEC, at their core, the reason that BEC is so effective is that it hijacks a trusted relationship where money is expected to change hands, to send money to criminals instead of the intended recipient.”

Seth Blank, CTO of Palisade.

How does this situation affect your organization?

Companies moving funds after the SVB and Signature Bank failures must share new account numbers, routing details, and payment instructions with vendors, clients, and payroll services. This exchange of sensitive data creates ample opportunities for attackers to intercept or spoof messages. A single misplaced email can result in a fraudulent wire transfer, potentially costing thousands or even millions of dollars. The heightened sense of urgency can cause employees to bypass verification steps, further increasing risk. As more institutions face scrutiny, the overall phishing threat landscape is expected to intensify.

To mitigate these risks, organizations should adopt a multi‑layered approach that includes strong email authentication, rigorous verification processes, and employee awareness training. By implementing these safeguards, you can reduce the likelihood of falling victim to BEC scams during this turbulent period.

What steps can you take to protect yourself?

Consumers should verify any email requesting banking details through a second, trusted channel—such as a phone call to the known number of the bank or vendor. Never rely solely on the information provided in an email, especially if it creates a sense of urgency. For businesses, deploying robust email authentication protocols like DMARC is essential to prevent spoofed messages from reaching inboxes.

DMARC is an email authentication standard that helps protect your domain from being used in phishing and BEC attacks. By enforcing DMARC, you can ensure that only authorized senders are allowed to send emails on behalf of your brand, dramatically reducing the chance of successful spoofing. Learn how to implement DMARC with Palisade’s free Email Security Score tool.

Start by gaining visibility into who is sending email on your behalf. Palisade’s Monitor service provides a comprehensive view of legitimate and illegitimate senders using your domain. Sign up for a free Monitor account to begin protecting your brand today.

Quick Takeaways

• The SVB and Signature Bank collapses have created a surge in urgent banking communications.
• Business Email Compromise (BEC) scams have already cost over $43 billion in the last five years.
• Attackers exploit the chaos by spoofing account‑opening and fund‑transfer emails.
• Implementing DMARC dramatically reduces the risk of email spoofing.
• Use Palisade’s free Monitor tool to see who’s sending email on your domain.
• Always verify banking requests through a secondary channel before acting.
• Employee training and strict verification processes are critical during crisis periods.

FAQs

Why are BEC attacks increasing after a bank collapse?

Bank failures generate a flurry of new account setups, routing changes, and urgent payment requests. This creates a high‑volume, high‑urgency email environment that attackers can exploit to impersonate trusted parties and request funds.

What makes DMARC an effective defense against BEC?

DMARC builds on SPF and DKIM to verify that an email originates from an authorized sender. When enforced, it blocks spoofed messages from reaching recipients, cutting off a primary attack vector for BEC scams.

How can I quickly check if my domain is vulnerable?

Use Palisade’s free Email Security Score tool to scan your domain for authentication gaps, misconfigurations, and unauthorized senders. The report provides actionable steps to improve your email security posture.

Should I train my staff on BEC awareness during a crisis?

Absolutely. Crisis periods increase the likelihood of rushed decisions. Regular training on how to spot phishing cues and verify requests can dramatically reduce successful attacks.

Is a free Monitor account enough to protect my organization?

Monitor gives you visibility into legitimate and illegitimate senders, which is a crucial first step. For full protection, combine it with DMARC enforcement and ongoing employee education.