74. An unexpected and out-of-character email message from a Chief Executive Officer's corporate account asked an employee to provide financial information and to change the recipient's contact number. Which of the following attack vectors is most likely being used?
Answer: A
Business email compromise
This scenario describes a situation where an email from a CEO's corporate account is used to manipulate an employee into providing sensitive information, which aligns with the characteristics of business email compromise (BEC). BEC typically involves impersonating a high-level executive to exploit employees for financial gain or sensitive data.
A) Business email compromise
This option is correct because it accurately describes the technique used in the scenario. Business email compromise involves a fraudster impersonating a high-ranking official within a company to deceive employees into providing confidential information or performing unauthorized actions, such as transferring funds or sharing sensitive data.
B) Phishing
While phishing often involves deceptive emails, it usually targets a broader audience and may not specifically impersonate a high-level executive. In this case, the targeted nature of the email, specifically from a CEO, indicates a more sophisticated attack that is characteristic of business email compromise rather than general phishing.
C) Brand impersonation
Brand impersonation typically involves creating fake accounts or emails that mimic a well-known brand to deceive customers. However, this option does not fit the scenario, as the email is sent from the legitimate corporate account of the CEO, making it a direct case of impersonation within the organization rather than impersonating an external brand.
D) Pretexting
Pretexting involves creating a fabricated scenario to obtain information from an individual. Although there is an element of pretexting in the scenario, the specific nature of impersonating a CEO for financial information makes business email compromise the more precise label for this attack vector.
Conclusion
Business email compromise is the most accurate description of the attack vector used in this scenario, as it involves the manipulation of an employee through the impersonation of a high-ranking official for financial gain. Other options, while related, do not specifically capture the targeted and deceptive nature of this type of attack within a corporate context.