A Practical Solution Against Business Email Compromise (BEC) Attack using Invoice Checksum

Abstract

This research presents a practical countermeasure against the problem of the bogus invoice scheme, one of the most threatening BEC attacks in modern business. We introduce a straightforward yet highly practical method of creating a checksum from the invoice and shared secret information. Using the generated checksum allows the recipient to confirm the authenticity and integrity of the invoice before proceeding with the actual payment. In this work, generating and verifying of checksum information are done via a smartphone application. Also, the predetermined secret information is stored inside the smartphone to provide better protection against data theft. Lastly, an Android-based application for checksum generation and verification, supporting both manual input and QR code scan, is implemented to demonstrate the use case scenario and practicability of the proposed method.