How phishing works and what to look out for…
How phishing affects businesses is something that OSD Digital Agency are eager to highlight. The FBI released figures showing phishing and CEO Fraud scams has cost US businesses $3.1 billion.
(BEC) Business Email Compromise, also known as CEO Fraud, is on the increase so it’s important to know how CEO Fraud works.
The fraudster impersonates the CEO and attempts to get an employee or vendor to transfer funds.
Most notable in Ireland, it happened to Meath County Council in 2016, when an email purporting to be from the CEO asked for a transfer of funds, resulting in €4.3 million being frozen in a Hong Kong bank. This form of email attack is unscrupulous and it preys on the vulnerability of the employee or vendor.
It has happened to us in OSD, when our managing director Catriona Walsh spotted an email spoofed with her name but not her actual email address, asking for a transfer of funds. Catriona is vigilant when it comes to spoofing and phishing so no damage was done, thankfully.
Bogus Invoices
Variations of BEC can take the form of the “CEO” requesting a transfer of funds from an employee, a bogus invoice, impersonating a company lawyer requesting money to settle a dispute, etc. Data theft is another form of fraud, whereby an email is spoofed to a client requesting data for HR or financial reasons. No money request is mentioned but it can be a launch pad for another attack, where funds will be requested.
The advice from OSD is to always ask, pick up the phone and call the office you receive the email from, with the number you are familiar with and query the payment request. Properly view the email, check that email address is correct and shows their proper email address – @osd.ie as an example.
Phishing
So what does phishing mean? Phishing is an attempt to gain sensitive data such as passwords and financial data from an unsuspecting user. At OSD as much as any business, we get phishing attempts quite regularly. The most recent one received was from someone spoofing MailChimp.
The email asked us to “Verify Domain Access”, however, a quick mouse over the button revealed that it was not from a MailChimp domain – this is known as Deceptive Phishing. Also apparent to ourselves was the sender email was not from Mailchimp.com, as we know how to spot these phishing emails. These emails are quite clever, they give the impression of the company that they are trying to misrepresent, using fonts, logos and slogans that the legitimate company uses.
Spear phishing comes in the form of targeting the user directly, using their name, position and phone number to give the impression that they have a connection with the person. This personalised attack is to lure the victim into providing sensitive data, through clicking on a link or attachment. This form of attack is prevalent through social media sites, such as LinkedIn.
Pharming is another type of phishing to watch out for, also known as a DNS poisoning attack. The attacker changes the IP address of the associated website name, giving the impression that the user is logging in as normal, even though they are being redirected to an erroneous site. You should always looks out for the SSL Secure Cert to ensure safety.
OSD Digital Agency are available to provide training to help with issues, like how to spot phishing, and we can help protect your Content Management System from attack with regular updates to the core and plugins.
Please call the office on 071 9170024 or contact us for further assistance.
