Case Studies > Account Update / Invoice Fraud Attack

Account Update / Invoice Fraud Attack

Customer Company Size

Large Corporate

Region

America

Country

United States

Product

Abnormal Behavior Technology (ABX)
Abnormal Identity Model
Abnormal Relationship Graph
Abnormal Content Analysis

Tech Stack

Natural Language Processing
API-based Office 365 Integration
G Suite Integration

Implementation Scale

Enterprise-wide Deployment

Impact Metrics

Cost Savings
Customer Satisfaction
Digital Expertise

Technology Category

Cybersecurity & Privacy - Identity & Authentication Management
Cybersecurity & Privacy - Network Security
Analytics & Modeling - Natural Language Processing (NLP)

Applicable Industries

Telecommunications

Applicable Functions

Business Operation

Use Cases

Fraud Detection

Services

Cloud Planning, Design & Implementation Services
Cybersecurity Services
System Integration

About The Customer

The customer in this case study is a telecommunications company referred to as TCC. Telecommunications companies are critical infrastructure providers that offer a range of services including internet, phone, and television to both consumers and businesses. These companies often handle large volumes of financial transactions and sensitive customer data, making them prime targets for sophisticated cyber-attacks. TCC, like many other companies in this sector, relies on a network of vendors and partners to maintain and expand its services. The company employs a large workforce and has multiple departments that handle various aspects of its operations, from technical support to financial management. Given the scale and complexity of its operations, TCC requires robust security measures to protect against various types of cyber threats, including Business Email Compromise (BEC) attacks.

The Challenge

The telecommunications company (TCC) faced a sophisticated invoice fraud attack where an attacker impersonated a legitimate vendor to redirect a payment of over $700,000 to the attacker's account. The attacker used domain impersonation and engaged multiple employees over two months to build credibility and execute the attack.

The Solution

Abnormal Security detected and stopped the attempted invoice fraud using its Abnormal Behavior Technology (ABX). ABX combines the Abnormal Identity Model, Abnormal Relationship Graph, and Abnormal Content Analysis to detect and prevent such attacks. Specific techniques used include domain impersonation detection, natural language processing for text analysis, and vendor relationship detection. The solution was implemented in passive mode, allowing for a comprehensive view of the attack lifecycle without impacting email flow. Abnormal Security's platform integrates seamlessly with Office 365 and G Suite, requiring no configuration and minimal setup time.

Operational Impact

Abnormal Security's platform detected the domain impersonation early, raising suspicion and preventing the fraudulent payment.
The use of Abnormal Behavior Technology (ABX) allowed for high-confidence decisions, ensuring that legitimate transactions were not disrupted.
The platform's natural language processing capabilities helped in understanding the context and sentiment of the emails, aiding in the detection of the fraud attempt.
The integration with Office 365 and G Suite ensured that the solution was easy to deploy and did not impact the company's email flow.
The detection of the attack during the evaluation phase demonstrated the effectiveness of Abnormal Security's solution in real-world scenarios.

Quantitative Benefit