Attacks on Business Email Accounts Are Surging

Emails have become an essential tool for any successful business, but as the saying goes, “with great power comes great responsibility.” For Phoenix-based businesses and beyond, fake emails are a growing concern. As a business owner, it’s crucial to ensure your emails are secure. This is one of the key ways to prevent your business data from falling into the wrong hands.

Understanding Business Email Compromise (BEC)

What is a BEC Attack?

Business Email Compromise (BEC) is a growing threat where scammers pose as high-ranking business individuals like CEOs, executives, or IT staff. Their goal is to trick employees into sharing sensitive information or sending money. Research shows that nearly 90% of BEC attacks occur this way.

Why Are BEC Attacks Dangerous?

1. High Trust Levels: Employees trust emails from their bosses or IT department.
2. Quick Response: In a fast-paced work environment, employees might not think twice before responding.
3. Huge Financial Impact: Falling victim to a BEC attack can be extremely costly.

The Rise of Fake Emails

BEC attacks have spiked dramatically this year, especially in the third quarter. Researchers analyzed 1.8 billion emails worldwide and found 208 million malicious emails among them. More than half (58%) were BEC attempts. The figures make it clear: BEC scams are now the biggest email threat to businesses.

Targeting the Vulnerable

Most BEC scams target lower-level employees who are less likely to question authority or be aware of cyber threats. These employees might:

• Quickly act on an email from a trusted source.
• Lack training in identifying suspicious emails.
• Be less aware of the latest phishing and scam tactics.

Other Common Email Threats

While BEC attacks are prevalent, scammers also use other methods like:

• Commercial Spam: Unwanted promotional emails.
• Phishing Attacks: Emails designed to trick people into sharing personal information, such as login details.

The combined effect of these scams now overshadows traditional ransomware and malware attacks.

Taking Action to Protect Your Phoenix Business

Simple and Cost-Effective Measures

Protecting your business from fake emails doesn’t have to be complicated or expensive. Here are some steps you can take:

1. Employee Training: Ensure all team members are trained to scrutinize every email they receive.
2. Verification Protocols: Encourage employees to verify requests for sensitive information or financial transactions by checking directly with the sender through a different communication channel.
3. Email Filters and Tools: Use email filtering tools to detect and block phishing attempts.
4. Regular Updates: Keep your email security systems up to date.

Best Practices for Email Security

• Strong Passwords: Use strong, unique passwords for email accounts.
• Two-Factor Authentication: Implement two-factor authentication for added security.
• Regular Backups: Ensure regular backups of important email data.

Conclusion

Attacks on business email accounts are on the rise, especially targeting Phoenix businesses using fake emails. It’s essential to act now to secure your business communications. Train your employees, verify suspicious requests, and utilize security tools to defend against these threats.

If you need help ensuring your business is secure, get in touch with MicroSupport. We’re here to support your success with expert, friendly, and professional IT solutions.

Contact MicroSupport Now!

When it comes to daily news, cyber-attacks and data breaches are becoming as common as morning brew headlines. Have you ever heard about eminent websites being vulnerable, leading to data leaks containing your email and password details? Your desktop may fall prey to malware that can sneakily capture your bank or credit card details. The most distressing cases lead to identity theft – a crime that’s easy to execute with hefty outcomes for cybercriminals.

Gone are those simpler days when we trusted passwords to keep our data safe. Currently, cyber attackers employ advanced methods like phishing, pharming, and keylogging to snatch away your password. Some cyber thieves can even bombard your account with billions of password combinations.

Like most users, if you have the habit of using identical passwords for multiple websites, you are at an elevated risk. Anyone who cracks your password doesn’t just gain access to one account, but all that you’ve used it for. Alarmingly easy to access personal trivia like your first pet’s name or your high school mascot merely adds to this vulnerability.
Think of a jewelry store. Do they only depend on a lock and key to protect their precious items? Not at all. They would have multiple layers of security such as alarms, motion detectors, and sometimes even reinforced windows. Your data is just as precious and needs more than one security layer for effective protection.
That’s where 2-Factor Authentication (2FA) comes in – consider it the digital equivalent of an extra protective layer for your valuable data. Also known as multiple-step or multi-factor verification, it is an extra step to confirm a user’s identity. Depending on your security settings, this could be activated every time you sign in or only under specific conditions, like signing in from a new device or location.

You will find 2FA options across many services you may use already, like Facebook, Gmail, and Xero Accounting among others. If you’ve ever received a unique verification code via text or email from your bank before gaining access, you’ve utilized 2FA. It can also take the form of a smartphone app or a physical electronic token.
2FA is especially crucial for online banking, email, online shopping (Amazon or PayPal), cloud storage services (Dropbox or Sync), password managers, communications apps, and productivity tools. This importance multiples if you frequently use the same passwords for different websites and applications.
While some may perceive social networks as relatively safe, weak security for these accounts can compromise many connected apps and websites. A lot of websites and apps offer sign-in options through your Facebook or Twitter account for convenience. Strengthening the security of these networks ensures that someone who cracks your password doesn’t gain sweeping access to all linked accounts.

The essence of implementing 2FA is to set up daunting hurdles for hackers, making it harder for them to gain unauthorized access to your personal data.
Navigating the realm of online security can be daunting. At Microsupport, our seasoned technicians simplify this process, ensuring seamless security for all your digital needs. With over 10 years of experience building solid, secure IT infrastructures, we’re here to safeguard your digital life.
Don’t leave your digital security to chance. Establish your 2FA protective layer now and let Microsupport secure your online presence. Contact us today – we’re just a call away at 602-692-7300.

BEWARE – It happens every day… scammers are after your money or personal information. It usually happens one of three ways:

• They call you on the phone – pretending to be from “MicroSoft”, “Windows”, Dell, or a generic techie sounding name.
• They tell you to call a phone number – via an annoying pop-up or voice on your computer.
• You call them – thinking you’ve found a legitimate tech support company via a Google search.

In each case, they’ll tell you a great story that has been honed by thousands of calls to other people. They’ll attempt to convince you there is something very wrong with your computer, or that you’ve been hacked and are at risk of identity theft or worse. In most cases they will get into your computer remotely to “fix things”. Of course, things are worse than they thought, and they will need money to fix things. They’ll scare you in many ways and may even run programs that generate false error messages.

These bad guys will take every opportunity you give them. One of our clients admitted to giving them 3 different credit card numbers, as the crooks kept saying “oh, that one was declined”. Another read them the routing numbers from the bottom of a check. And another realized something was up as she found herself driving to Target to buy $1500 worth of iTunes gift cards!

It doesn’t stop at taking your money. While they are in your computer, the crooks can find names, numbers, account information, passwords, birthdays, and banking information.

A recent Microsoft survey showed 15% of the people surveyed had received fake tech support calls. Of those, 22% admit to falling for the scam, including letting the bad guys into their computers, and even giving them money. The average financial loss was $875, plus over half reported subsequent computer problems.

The bad guys are hard to catch, but thanks to efforts from companies like Google and MicroSoft and Federal authorities, they are being taken down every day. Unfortunately, it seems two pop up for every one taken down.

Don’t become a victim! Don’t fall for the Fake Tech Support Scam!

It usually starts with a client saying “I assume we’re protected”. The hairs go up on the back of my neck, and my pulse quickens. They don’t get it… those 4 words tell me some serious education is necessary.

We’re talking about computer viruses or malware and protecting your computer system. The danger of those 4 words is that they insinuate that some outside force or mechanism is responsible for protecting you from disaster, and it couldn’t be farther from the truth. The truth is that 99% of the protection comes from you and your staff, since most of the infections result from personal attacks against YOU. Computer hackers seldom directly attack computers, operating systems, or browsers any more. They’ve discovered it is far easier to trick you into attacking yourself. And if they can cause you to click on something, your antivirus/antimalware products cannot protect you.
Does that mean you can get rid of your antivirus or antimalware software? Probably not, as they might protect you from older viruses, or maybe new ones. And since the “standard of care” is still antivirus programs, it might be considered negligence if you didn’t have one.

Your best protection against infections and data breaches is education. Understanding that YOU are the first line of defense, and staying educated on the current nature of attacks. For instance, education would alert you to the fact that the attacks have recently been tailored for specific industries. CPAs get pop-ups or email links that seem appropriate for the accounting profession, like Emails saying they have tax information, invoices, or banking information. There are even malware scams embedded in fake messages from the IRS. Lawyers are now getting supposed bankruptcy notices, or fake messages about legal seminars.

The scams are continually evolving, but the target is still the same: Your money or your data. Most recently, they’ve combined into an attack called “Ransomware”, where you pay money to get your data back. It starts with one simple click in an Email message. The next thing you know, you can’t open files stored on the computer or even the firm’s server. All of your data, documents, spreadsheets, PDFs, pictures, videos, music, and even accounting data is encrypted and held for ransom. Pay $300-$1500 immediately or lose everything. And the price goes up as the deadline approaches, usually 24-48 hours.

These ransomware programs can also wreak havoc on systems that make use of “synchronizing” systems like DropBox or OneDrive. Now a local disaster can be spread, or synchronized, to other computers in the firm, city, or across the Country. An infection in the office can now affect home, and visaversa.

And here’s a chilling thought… As long as a bad guy is going through your data  to encrypt it, what’s to stop him from stealing information about you or your clients? Names, addresses, account numbers, Social Security numbers, passwords, birthdays, you get the idea. If they don’t use it themselves, they’ll sell it to the highest bidding identity thief.

Which brings up the topic of backups. Depending on the infection, backups may be your only source of recovery. Therefore the importance of backups cannot be overlooked, and having backups that are “off-line” is essential. Some of the infections actually target your backups, too! Those 4 scary words “I assume we’re protected” are also applicable to backups, too. It is your duty to make sure backups are adequate and actually running. Never assume “someone else” is responsible. You need to know what is being backed-up, to where, and how to check the backups. Just because a person setup the backup routines, it doesn’t mean they are responsible for checking on them… make sure you know who is responsible for making sure the backup system is working.

Have you noticed that many entities, Worldwide, have requested that users reset their passwords?  You’ve probably heard about the countless security breaches involving major companies and government offices. Sure, they might involve credit card numbers, or even personal information… but, perhaps more important, HUNDREDS OF MILLIONS OF LOGINS AND PASSWORDS HAVE BEEN STOLEN. Many hundreds of millions more have been stolen from smaller organizations that you’ll never hear about.
Initially, these logins/passwords may be used directly by the thieves, or sold around the World. Eventually, the information is available, for free, through hacker websites.

Recently, major companies (like GoToMyPC, Carbonite, & LogMeIn) have started reviewing some of the stolen login/passwords that have been circulating in the criminal World. To their horror, they’ve found that many of the stolen login/password combinations work on their websites and, in fact, are noticing specific attacks that are utilizing this stolen information.

Because of these widespread and increasing attacks, many companies are ramping up their security and asking all users to change their passwords immediately. In many cases you have no choice, as you will not be able to access your account without a password change.

Unfortunately, many of us use the same login and simple password for many different accounts. It’s easier that way. Some people think they’ve fixed the problem by using more complex passwords, utilizing upper and lowercase letters, numbers & symbols.

The root of the problem is that we tend to use the SAME PASSWORD. Now that the logins and passwords are out there, it’s easy enough for criminals to try a given stolen login/password at hundreds of websites. Like your bank, Amazon, Ebay, dating sites, or government websites. And in each website they get into, they can find more and more information about you, all leading to potential identity theft or financial loss.

The only answer is: Change all of your passwords, use complex passwords, and DON’T USE THE SAME PASSWORD for all websites!!! It’s your choice: Security or Convenience… you can’t have both.

If you want to see if your email address (and password) are floating around in the Dark Web, just visit the site https://haveibeenpwned.com.   This is by no means a comprehensive listing of all compromised logins… in fact it represents a tiny portion of what’s out there, but it should be enough to give you a good scare.