Hello, my name’s Brian Mangum. I’m a local data security and IT expert, and the owner of
BrightFlow Technologies.
At least once a month our phone rings and
it’s a local business that has found itself compromised in some way.
The outcome is almost always the same – money has gone from the business bank account.
Stolen.
And 9 times out of 10, the entry point is the same, too. An email account somewhere in the business has been compromised in some way.
When you think about it, the very nature of email makes it the weakest point of any security set up. For many of us, it’s both our greatest tool and most hated nemesis at the same time!
You have lots of staff accepting hundreds of emails every day. And even the best email filters in the world can’t stop clever hackers. Because they’re constantly inventing new ways to get in.
All they need is for one member of your staff to click on their link, and that can give the hackers enough access to start monitoring what the business is doing. From there, they can easily spot ways to access business funds.
If a hacker can actually get control of your email, they can usually go on to access multiple other systems and applications.
Why? Because when you forget your password on most systems, you enter your email address, and it emails you a link to click. That huge convenience comes at a scary cost.
Common email scams and hacks
For far too many businesses, email security isn’t an issue…
until it suddenly is.
Not enough companies put into place a proactive, preventative security strategy until they’ve been hacked. That’s like waiting until you’ve been robbed to put locks on your front door.
There are lots of different types of email hacks. These are the most common ones we have either seen ourselves or heard about from our network of international IT security experts.
Email Forwarders
This is where hackers gain access to your email
just once, and then put in place an email forwarder. Then, without your knowledge, all incoming email is forwarded to them. They might not be able to see every reply you send, but it’s usually quite easy for them to spot patterns, such as invoices being sent to
you on a regular basis. An email forwarder is often the starting point for hackers. From there, they can play a long game—gathering information and build- ing up a profile of their target, until the opportunity presents itself to steal some money.
Spoofed Domains
Just as David discovered, one scam is to buy a domain name that’s very similar to the real domain. Your supplier might use xyzcompany.com, and the hacker buys xyzcommpany.com. That extra character will often go unnoticed. Another trick is to buy a domain with a different extension, such as a .net rather than a .com.
Follow-up Emails
The follow-up email is a clever trick, and exactly how David’s ops manager was fooled. If the hackers can time it right, they can send a follow-up email im- mediately after the real email, and most people just assume it’s real.
Compromising a Supplier’s Email
If the hackers can compromise your supplier’s email and intercept the outgoing invoices, they can get a range of customers to pay money to the wrong bank account. Actually, flip that around and imagine
a hacker has adjusted all of your invoices, so your customers were making payments, but not to your bank account.
Edited PDF
Many people think a PDF is a safe document, but in fact, they can easily be edited. We’ve heard of hackers intercepting invoice PDFs, editing them to change the bank account details, and then sending them to customers. The person paying the invoice typically has no idea.
Using Keyloggers to Directly Access Bank Accounts
Hackers install malware that sends information to them on every button you press, They can use this to see you have visited a bank’s website, and over a period of time, they can put together much of the information you use to log-in.
Social Engineering
Once a hacker is inside your email, they will gather information and look for opportunities. A golden chance for them is when the boss is on vacation because that’s a break in normal patterns of behavior and they can leverage that.
We heard of one company where the boss’s email had been compromised with an email forwarder. The hackers couldn’t send an email from the account,
so instead, they set up a Gmail account in the boss’s name and emailed someone senior in the company. “My work email’s not working so I’m using my personal email,” the message read. “Having a great time in Miami, but I forgot to pay an invoice before I left – can you pay this quickly, please?”
Inevitably, the staff didn’t think twice.
In another example, the hacker sent a Gmail pre- tending to be the boss, and said he’d been locked out of their Office 365 account. They asked the office administrator to reset the password and gained full access to the boss’s email while he sat on the beach, totally unaware that he’d been hacked.
Staying on that theme – if there was one thing we would enforce within every business we protect, it would be this: Never let the boss break protocol!
Businesses have systems put in place designed to protect them. Then the boss will send an email asking for an urgent payment to be made – and the staff will comply! This sets up circumstances for easy fraud. Any hacker sitting monitoring email traffic will see this happening and know it can be leveraged.
- There are 1.7 billion pieces of malware out there, all trying to infect your inbox.
- Hackers make a lot of money from cyber crime, with a reported return on investment of 1,425%!
- 60% of all companies have experienced a data breach in the last 2 years … many of which are the result of poor email security.
There are loads of scary stats out there – just Google “email security stats” to see for yourself.
Your 9 layers of security
If every business used every possible layer of email security, they’d reduce their chances of being hacked down to just 1% or 2%.
But they’d also struggle just to do business every day.
Because there are plenty of tools available to protect companies of every size. The trick is putting together the right blend to suit your business. So you’re protected, but your hands are not tied.
If you want to read a great story about how a specific business got targeted OR you want to read about the 9 layers of security that your IT TEAM should put in place,
Read our free book by visiting this link…
Or email info@brightflow.net with subject line FREE BOOK
