Guest contributor: Keith Tully, Partner, Real Business Rescue (part of Begbies Traynor Group)
A phishing scam provides a gateway for fraudsters to steal personal data or launch a ransomware attack and involves disguising a manipulated link, email, or text message, which when clicked on by the victim, unlocks the door to a bank of confidential data. Often it is the human firewall that allows the fraudsters in even when your IT security is strong.
This information is then used by the scammer to secure a payday by selling it to a third party or demanding a ransom, such as passwords, credit card details, or intellectual property. Phishing scams are often hidden in plain sight as fraudsters lure in the victim using sophisticated methods, such as company branding, professional language and references to real-life employees.
As phishing fraudsters refine their methods of deception, how are businesses sharpening their spears to catch out cyber scammers and shielding their comms systems against phishing attempts?
Although phishing scams are prevalent in the corporate world, the repercussions of a phishing attempt are often underestimated by business owners.
Just three in ten businesses (31%) have a business continuity plan that covers cyber security and just a quarter of businesses (23%) have cyber security policies that cover home working.
As a business owner, it’s your duty to store customer data under lock and key (or appoint a data protection officer to oversee this) and take the necessary steps required to keep this information away from the prying hands of fraudsters. If you hold client money, a successful phishing scam could have a long-term detrimental impact on your business and tarnish your reputation.
To protect your business against phishing attempts, you must educate staff on the different types of phishing scams that are common in the business world. This is vital as fraudsters know all too well that IT security has been ramped up, therefore the route through is manipulating or engineering your people so that they drop their guard to click on a link, open an attachment or worse, share access data.
Email phishing – A general non-personalised phishing email may arrive addressed from what appears to be a reputable organisation, such as a government body, entertainment provider or broadband supplier, requesting information or action from the recipient, such as opening an attachment or clicking on a link. The aim of such emails is either to extract personal information from the recipient or to install malware on their device allowing the cybercriminal access to the victim’s IT system.
Spear phishing is a type of email phishing whereby a personalised email is used to target a specific rank of employees at an organisation. Whaling is similar to spear phishing, although, emails are targeted at high-ranking individuals.
Phishing website – This is when a user is directed to a compromised web page, such as a website imitating a legitimate platform. Once they click on the page, the user may be locked out or a virus enters their system.
New data from Action Fraud, the national reporting centre for fraud and cybercrime, found that 20,144 people fell victim to scams where they were persuaded to grant criminals remote access to their devices. Victims reported losing a total of £57,790,384 – an average loss of £2,868 per victim.
There are a number of red flags to watch out for within phishing emails including:
Human error has been identified as the biggest contributing factor to cybercrime; therefore, it is imperative that employees are given regularly updated training and information to help spot scams.
In addition, there are a number of actions that businesses can take to protect against cyber-attacks, such as:
If your business falls victim to a phishing scam, you must follow these steps:
If confidential data falls into the wrong hands and the breach is likely to result in a high risk to the rights and freedoms of individuals, you must inform the victims, such as employees, suppliers, or customers, directly without delay. Not only can this retain trust, but it can also provide you with an ideal opportunity to provide reassurances before the breach is made public.
Keith Tully is a partner at Real Business Rescue, part of Begbies Traynor Group. Real Business Rescue is dedicated to providing company restructuring and insolvency advice to company directors in financial distress, including those that have fallen victim to phishing scams and cyber fraud.
Should you suspect that you are a victim of fraud or other wrongdoing, please do not hesitate to get in touch at hello@tenetlaw.co.uk
Tenet Compliance & Litigation Limited
10th Floor, Lyndon House, 62 Hagley Road, Birmingham, B16 8PE