Phishing scams have long been an effective social engineering technique used by criminals to adversely affect individuals and businesses. These phishing schemes typically target individuals by disguising emails to look legitimate, while in reality they are seeking to gain personal information or to infect the individual’s personal device. The recent direction of phishing attacks is to target larger organizations and businesses, rather than individuals, as the data held by organizations can be more valuable to the scammer. Invoice Scams are the emerging trend among phishing attacks, and can have a costly impact on your business if successfully operated.
Invoice Scams typically work in the following order:
- A scammer targets an individual within an organization by seeking out specific information about that person on either a corporate website or a social media site where a job description might be posted (like LinkedIn). The scammer can use information pulled from these sites to target employees who may work in the accounting or procurement departments.
- The scammer composes an email with an attached invoice that is disguising malware or ransomware. In some instances, the body of the email might even include specific details or vendor information, making it look like a work-related document.
- An employee receives the email and downloads the attachment, thinking it is legitimate. The spyware/ransomware is now installed on that user’s workstation and can corrupt the business IT environment.
- The scammer can now perform multiple nefarious activities, such as encrypting files and demanding ransom or logging keystrokes to capture personal or confidential data.
- The business suffers reputation damage and/or financial harm as a result of the successful attack.
Take these steps to protect your staff:
Invoice scams are more successful than other phishing attacks because they target specific individuals within an organization who are known to process payments as part of their everyday job duties. While these attacks can be hard to defend against, there are some steps that can be taken:
- Train all workforce members on the importance of phishing attacks. Employees should be taught on an annual basis how to identify and report any email that looks to be suspicious. You can conduct phishing tests to validate the effectiveness of your training methods.
- Exercise vigilance. Since these scams are becoming a common issue, employees in departments that deal with invoices should exercise extra caution in reviewing any email. If any unexpected invoice comes in from a current vendor or partner, always confirm the source of the email before opening any attachment.
- Ensure that anti-virus and anti-malware software is installed and routinely updated on all office workstations. For larger organizations, it may be best to implement a separate email security software to provide an extra layer of security.
Phishing scams have proven to be extremely costly to businesses in the past. Hackers are continuing to evolve their efforts into gaining access to sensitive data. Ensure your business is staying ahead of these threats by implementing strong cybersecurity practices.