Business Cybersecurity Tips

Fake checks drive many types of scams- like those involving phony prize wins, fake jobs, mystery shoppers, online classified ad sales, and others. In a fake check scam, a person you don't know asks you to deposit a check-sometimes for several thousand dollars and usually for more than what you are owed- and wire some of the money back to that person. The scammers always have a good story to explain the overpayment- they're stuck out of the country, they need you to cover taxes or fees, you need to buy supplies, or something else. But by the time your bank discovers you've deposited a bad check, the scammer already has the money you sent, and you're stuck paying the rest of the check back to the bank.

The Federal Trade Commission receives tens of thousands of reports each year about fake checks. Over the last three years, the number of complaints has steadily increased, and so have the dollars lost.

The FTC's new info graphic developed with the American Bankers Association Foundation, offers some tip-offs to rip-offs and what to do if you get a check from someone you don't know.

Please share this information with others. Victims may be embarrassed to talk about their experiences, but you can help. A simple phone call, email or text, saying "Look what I just found" and sharing this information may make a difference in someone else's life.

Scammers are always finding new ways to steal your money using cryptocurrency. To steer clear of a crypto con, here are some things to know.

Here are some common investment scams, and how to spot them.

• Multi-Factor Authentication (MFA): This is one of the most effective ways to prevent ATO. MFA requires users to provide multiple forms of identification before granting access, making it much harder for attackers to gain entry even if they have stolen a password. Use more secure MFA methods like app-based authenticators or hardware security keys, which are less vulnerable than SMS-based MFA.
• Strong Password Policies: Enforce policies that require complex passwords (combining letters, numbers, and special characters) and encourage or mandate regular password changes. Recommend the use of password managers to help employees generate and store strong, unique passwords for every accounts.

Business face an evolving landscape of AI-powered scams that leverage sophisticated technology to deceive and defraud. Understanding these threats is crucial for effective protection.

Here are some of the most prominent AI scams businesses need to be aware of:

• How it works: AI algorithms can craft highly personalized and convincing emails or messages that mimic legitimate communications, making it harder to detect them as fraudulent. AI can analyze public information and online behavior to tailor messages, increasing the likelihood of recipients falling for the scam. AI also helps scammers create fake websites and landing pages that look identical to legitimate ones, further enhancing the deception.
• Why it's dangerous: The AI-driven phishing attacks can bypass traditional spam filters and trick employees into revealing sensitive information like login credentials, potentially leading to a significant financial loss or reputational damage.
• Protection: Businesses should educate employees on recognizing the red flags of AI-powered phishing, including scrutinizing sender email addresses, being wary of unusual requests, and verifying information through official channels. Implementing multi-factor authentication (MFA) on all platforms is also essential.

To protect against email account compromise, staying vigilant and practicing good cybersecurity hygiene is crucial. This includes using strong, unique passwords, enabling two-factor authentication, being cautious of suspicious emails or links, and regularly updating devices and software.

 

Business and personal accounts can be compromised in various ways, such as malicious phishing emails sent to employees or a data breach allowing unauthorized users to gain access. Weak passwords, malware, and social engineering attacks can all compromise personal accounts.

 

• Email Account Compromise (EAC): Hackers most commonly gain access to people's email accounts by planting malware on their computers, usually after the victim has fallen for an initial email phishing scam. This can lead to various fraudulent activities like sending spam emails and stealing sensitive information- or sending official-looking messages to other contacts from the victim's email, trying to trick users into giving up personal or financial data.
  
• Account Takeover (ATO): ATO occurs when a cybercriminal takes control of an individuals online identity and impersonates that person. Attackers can exploit these compromised accounts for financial gain and other malicious activities.
• Business Email Compromise (BEC): BEC refers to an attack where cyber criminals target employees responsible for financial transactions or sensitive information. Attackers often impersonate high-ranking executives, tricking employees into making unauthorized wire transfers or sharing sensitive data.
• Credential Stuffing: In this attack, attackers use username and password combinations obtained from previous data breaches to gain unauthorized access to various online accounts, including email accounts. They rely on the fact that many individuals reuse passwords across multiple platforms.

The goal of the cybercriminal is to steal funds, redirect paychecks, or otherwise affect funds of the targeted victim.

 

In one specific type of scam, cyber criminals buy ads that masquerade as legitimate companies to misdirect victims searching for a specific website through popular search engines such as Google, Yahoo, or Bing. The search engine may return a fraudulent website URL that is very similar to the legitimate website, or slightly misspelled, or re-directed to another website with the URL that appears legitimate.

 

When victims click on the fraudulent search engine ad, they are directed to a sophisticated phishing site that mimics the real website, tricking victims into providing their login information. Cyber criminals then capture victims' credentials as they access the fraudulent site. 

 

If the account requires multi-factor authentication, cyber criminals may utilize social engineering to obtain the One-Time Passcode (OTP). For example, cybercriminals pretend to be a bank employee or technical personnel and requests the victim to provide their phone number via fraudulent website's chat box. The cybercriminal then contact the victim while pretending to be the bank employee/technical support and ask for the OTP.

 

If the account is a corporate account which requires two individuals to authorize a transaction (dual control) then, cyber criminals may utilize social engineering in a similar manner as above, and insist that the second individual go to the same website, and/or go to the open browser of the first individual to complete the transaction. Cybercriminals then use the captured credentials to gain full access to the victim's financial account. If a bank account is compromised, cyber criminals can transfer money from the accounts. If an employer payroll account, health savings account, or retirement account is accessed, the cybercriminal can change the direct deposit information in the real site and redirect funds. If cyber criminals gain access to full personally identifiable information (PII) for victims, they can also create new account relationships, including loans or accounts that defraud victims. 

 

To remain on guard against ATO, follow the tips below:

• Be careful about the information you share online or on social media. By openly sharing things like a pet's name, schools you've attended, your date of birth, or information about your family members, you can give scammers all the information they need to guess your password or answer your security questions.
• Monitor your financial accounts on a regula basis for irregularities, such as missing deposits.
• Always use unique complex passwords, enable two-factor authentication on any account that allows it, and never disable it.
• Use Bookmarks or Favorites for navigating to login websites rather than clicking on Internet search results or advertisements. Multi-factor authentication will not protect you if you land on a fraudulent login page. Carefully examine the email address, URL, and spelling in any correspondence.
• Stay vigilant against phishing attempts. Be suspicious of unknown "banking" or "company" employees who call you; don't trust caller ID. Offer to call them back after you look-up the phone number yourself. Remember that companies generally do not contact you to ask for your username, password, or OTP.

You can protect your business from tax fraud scams and cyber attacks by implementing employee cybersecurity training and data privacy verification procedures, such as:

• Do not share social security numbers or any tax documentation with unknown parties.
• Keep an eye on your credit report to see if any bank accounts are being opened in your name.
• Look for any business loans being taken out under your company EIN.
• Triple check information prior to sending any wire or ACH transfers. Call a known number directly (not using the email signature), and ensure that multiple parties review before pushing through any payment.
• Stop, think, and double-check rush demands with other team members or management. Threat actors tend to use urgency in an attempt to rush people to make a mistake.
• Do not open attachments unless it is one you expected. If in doubt, have IT look at the email in an abundance of caution.
• Do not allow someone requiring access to your computer unless you can confirm whether they are legitimate with your IT department. Always gather their contact information, confirm and call back if necessary. It is not common practice for someone unknown to call and ask for remote access.
• Use secure passwords and don't share or reuse them.
• Ensure your communicate with an authentic individual and not an imposter trying to steal personal and financial information. If you are not familiar with the person's name, verify their relationship with your company before sharing any data.
• Utilize multi-factor authentication (MFA) when filing taxes online. Use a tax preparing service that requires a username, complex password and MFA.
• Update software on all devices and operating systems that connect to the internet. Having current software that is fully patched is a strong defense against viruses and malware.