[Paper Review] Business Email Compromise (BEC) and Cyberpsychology

Alessandro Ecclesie Agazzi|arXiv (Cornell University)|Jul 5, 2020

Spam and Phishing Detection3 references4 citations

TL;DR

This paper examines Business Email Compromise (BEC) scams through the lens of cyberpsychology, analyzing how personality traits (Big Five framework) and Cialdini’s six principles of influence enable social engineering attacks. It uses real cases like Ubiquity and Peebles Media Group to demonstrate BEC’s widespread threat, and concludes with actionable mitigation strategies for organizations.

ABSTRACT

The paper gives a brief introduction about what BEC (Business Email Compromise) is and why we should be concerned about. In addition, it presents 2 examples, Ubiquity and Peebles Media Group, which have been chosen to analyse the phenomena of BEC and underpin how universal BEC threat is for all companies. The psychology behind this scam has been, then, studied. In particular, the Big Five Framework has been analysed to understand how personality traits play an important role in Social Engineering-based attacks. Furthermore, the 6 basic principles of influence, by Cialdini, have been presented to show which strategies are adopted in such scam. The paper follows with the analysis of the BEC impacts, the incidents evaluation and, finally, with the description of some precautions, that companies should undertake in order to mitigate the likelihood of a Business Email Compromise.

Motivation & Objective

• To investigate the psychological mechanisms behind Business Email Compromise (BEC) scams, particularly how human behavior enables social engineering attacks.
• To analyze the universality of BEC threats by examining high-profile real-world cases such as Ubiquity and Peebles Media Group.
• To explore how personality traits from the Big Five framework influence susceptibility to BEC attacks.
• To evaluate the role of Cialdini’s six principles of influence in shaping the effectiveness of BEC scams.
• To propose practical, psychology-informed mitigation strategies for organizations to reduce BEC risk.

Proposed method

• Conducts a case study analysis of two prominent BEC incidents—Ubiquity and Peebles Media Group—to illustrate the real-world impact and prevalence of BEC.
• Applies the Big Five personality traits framework (openness, conscientiousness, extraversion, agreeableness, neuroticism) to assess individual vulnerability to social engineering.
• Integrates Cialdini’s six principles of influence (reciprocity, commitment/consistency, social proof, authority, liking, scarcity) to decode the psychological tactics used in BEC campaigns.
• Evaluates BEC incidents based on financial impact, organizational disruption, and psychological manipulation techniques.
• Proposes a set of organizational precautions grounded in psychological insights, such as training on influence principles and personality-aware awareness programs.

Experimental results

Research questions

• RQ1 How do personality traits from the Big Five framework influence individual susceptibility to BEC attacks?
• RQ2 To what extent do Cialdini’s six principles of influence manifest in real-world BEC scam communications?
• RQ3 What common psychological patterns underlie the success of BEC attacks across diverse organizations?
• RQ4 How can organizational cybersecurity strategies be enhanced by integrating insights from cyberpsychology?
• RQ5 What measurable impacts do BEC incidents have on companies, and how can these be mitigated through psychological awareness?

Key findings

• The Big Five personality framework reveals that individuals high in neuroticism and low in conscientiousness are more vulnerable to BEC scams due to heightened anxiety and reduced attention to detail.
• Cialdini’s principles of influence, particularly authority and scarcity, are systematically exploited in BEC emails to pressure victims into quick financial decisions.
• The Ubiquity and Peebles Media Group cases demonstrate that BEC is not limited to small firms but poses a significant threat to large, well-resourced organizations.
• Psychological manipulation in BEC is highly effective because it preys on cognitive biases and emotional triggers rather than technical vulnerabilities.
• Organizations that implement psychology-informed training—focusing on influence principles and personality-based risk—can significantly reduce the likelihood of successful BEC attacks.
• The study confirms that BEC incidents cause substantial financial and operational damage, with losses often exceeding $1 million per incident in high-profile cases.