Spoofs, Scams, and Phishing: Modern Thieves in a Digital World
As the common criminal evolves with today’s rapidly progressing technology, smarter crime creates a need for smarter approaches to preventing it. While most modern systems will filter out the most basic attempts at scamming your organization’s users, on occasion there will be convincing messages that slip through these filters and challenge your organization’s familiarity with modern scams.
We’ve prepared a few tips to make sure that your users are familiar with the most common types of scams in the industry today:
Spoofing is the common attempt of email scammers to make an email or message look as if it’s come from a legitimate source, either within your organization, or from another company. This involves setting up an account name so it will show as coming from a familiar user or company like Paypal or a Social Media site. These will often say that your account has been locked, or that you have made a payment that you don’t recall making, and then have you click a link in the email that will take you to ‘sign in on the website where your account has been locked.’ These emails often redirect to websites designed to look like the official source, but will actually steal your log-in information as you sign on.
This is what’s referred to as ‘phishing,’ which is when an individual tries to acquire information on accounts via misleading webpages, or will try to lead you to webpages that will install malware or ransomware on your device.
More commonly, scammers are beginning to target businesses by creating accounts identical to a user in an organization, often replicating the email addresses of CEOs, COOs, and other important decision makers in the company. These fake accounts will then send messages to users either asking for personal information—in some instances they are even instructing their users to use company credit and debit cards to go buy gift cards for fake promotional reasons.
If your CEO is suddenly asking for a £500 Google Gift card? Take a closer look at the email address the message comes from.
Opening the information for further detail from the sender should let you get a better look at the email address behind the person sending it, which will usually show odd variations on the sender’s email; is there an 0 where there should be an o? Is that lowercase L actually a 1? Sometimes the display name will show as a familiar user, but if you look at the address itself will show a completely unrelated email.
Always be wary of providing too much information in return, or communicating with suspicious requests–if in doubt, doublecheck with an actual phone call or forwarding the message directly to the address you know the person uses.
3. Artificial Blackmail
You receive an email from a mysterious source that claims that the sender cannot be traced, but that they’ve hacked all of your accounts / your website / your social media. They demand an exorbitant fee in Bitcoin or another Cryptocurrency, often threatening you with claims that they’ve recorded you through your webcam committing illicit actions, or that they have some other embarrassing secrets to leak to your workplace or friends and family (all contacts they have gained, of course, by hacking your account.)
Except they haven’t.
In the age where a skilled hacker is enough to make people quake in their boots, just the threat that someone or a company has been compromised is enough to inspire the vulnerability and doubts over the security of your personal information. These mysterious blackmailers have not gained access to your accounts, they’ve only gotten your email address off a mailing list somewhere and added you to a blind copy threatening hundreds of others with the same blackmail material.
You can delete them as normal as you would any spam.
How to prevent these misleading emails?
While there is no spam filter in the world that can catch these human criminals with 100% accuracy, most of these messages should automatically be sent to your junk mail automatically. For anything that does slip through, you can make sure that your organization or IT company has implemented an ‘External Email’ warning message.
This warning message will display on every email that your organization receives from an external source, and usually looks like the following:
Human error is persistent in falling for most of these scams, but with tools like this, it raises an additional red flag that something isn’t quite right with a message your users may have received.
If your organization does not already provide tools like this, or you’re looking for more comprehensive security coverage and other methods to combat these cyberattacks or worse, then contact our experienced Sales team here at 10-100 Consultancy Ltd.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.