The Biggest IT Security Threat To Any Business
Can you believe that in one poll, 83% of businesses said they had been victims of successful attacks last year? It’s easier to believe when you consider that just under a third of phishing emails are being opened. The odds are high that someone in your business will open one of these emails by accident.
The phishing criminals have taken a page from their sister criminals, the ransomware teams. They are using tactics that are designed to scare people to take immediate action and give away login information.
These new attacks start the same as the traditional phishing attack. You’ll might receive an “official” looking email, one that alerts you to some suspect activity on an account you may have with some company. These emails could say someone tried to login from an “unknown” location or device and the company blocked the attempt to login.
The email then says you need to take steps to inform the company that the attempted login was not you. Luckily there is a button to click to verify your login information.
The escalated danger comes from a countdown timer on the screen, that is usually set for an hour. If you don’t respond in time, the company will have no choice but to delete your account.
https://www.kaspersky.com/blog/email-account-stealing/28029/
Yes! Your account will be deleted!
Regardless of what you may have thought when you started reading the email, it now has your attention. Being manipulated by this tactic is powerful and is designed to provoke immediate action – before thinking things through.
Of course, when the timer gets to 0:00, nothing will happen to any account, but as the seconds tick away, there is a sense of urgency. You then start to think what would happen if the account was deleted.
If you click the button, you will be taken to a webpage with official looking logos that has a similar looking login process. Of course, this page is fake, it was designed to look just like a real authentication page. If you enter any information, criminals will take the data and use it themselves to login to your account.
https://www.kaspersky.com/blog/email-account-stealing/28029/
This “fake website” business has become very prevalent. There are now companies that identify these pages to protect companies from the criminals abusing their IP. According to Bolster, phishing is the most successful and potent attack vector for criminals. Bolster reports that there are currently 4.2 million fraudulent websites that derive $1.2 trillion in fraudulent product and service transactions.
Bolster has helped Zoom, to take down over 14,000 suspicious sites in ONE MONTH!
The possibilities are staggering. Data loss, financial fraud, or business crippling malware, and all the other accounts you may have with the same login information. This information could also be collated with other stolen credentials and sold on the dark web to other criminals.
Basic phishing protections for you and your team
- Closely review the sending email address
- Check to see if the spelling and grammar are both correct
- Look at the links in the message by hovering the cursor over the links to see the website address the link wants to take you to
- Review the website address carefully, look for something misspelled
What happens if you or a coworker get caught by this scam?
- It’s important that the login details to the account in question are changed immediately. This is where the real urgency is, especially if it’s your email account.
- Clicking a link in an email can expose you to these scams. Always open another tab in your web browser, type in the website address to the actual company, find the login page.
A password manager is highly recommended
Password managers (we love can automatically create strong, random passwords that are impossible to guess. These managers also store the passwords for you on your browsers (they can be used on your mobile devices too!). Autofill login boxes can save you time from filling out forms if you’ve been to the page before. The password managers can detect if they are trying to fill in information on a fake page and won’t fill in the information automatically.
It’s a good idea to share this with your coworkers or team so they are aware of these tips. And remember, if anyone clicks on a link they’re not sure about, reach out to us, to see how you can keep your business safe.
