By: Tim O’Pry | Chief Security Officer
Spear Phishing: (n) the fraudulent practice of sending emails ostensibly from a known or trusted sender in order to induce targeted individuals to reveal confidential information.
“Spear phishing represents a serious threat for every industry”
The incidence of spear phishing continues to increase. At Henssler, even though our inbound email is filtered through two different third-party services, well-crafted spear phishing attempts can still make it through. Why? Because it is almost impossible for the filters to tell fake emails from the legitimate. These emails are simply requests for routine functions that we perform on a regular basis. What set these apart is the criminals have taken the time to get the correct names, and in some cases format the request in a very believable manner.
We have seen multiple incidences of criminals purporting to be clients and employees trying to fool us into wiring money and changing payroll direct deposit accounts. Some of these have been “a cut above” the usual stuff our staff easily identifies as bogus. Fortunately, thanks to regular employee training as well as policies and procedures designed to confirm and verify these type of requests, none have been successful. However, we are always diligent and try to learn from each attempt—the bad guys need only succeed once, whereas we must get it right 100% of the time.
How the criminals obtain access to this information varies, but it shows a level of sophistication much greater than the average email scam artist. What makes this even more disconcerting is there are international gangs that specialize in these tactics, a few of which have been identified by authorities, but prosecution of cybercrime is extremely difficult and the possibility of recovered assets, almost nil.
The simplest and most effective way for you to protect yourself from spear phishing attempts is also the most old fashioned: simple one to one contact, either in person or via telephone. However, when using the phone, do not rely on a phone number that was provided in the suspicious email. Instead, look up the number separately. For example, if you receive an email purporting to be from a friend, financial, or government representative requesting you to send or electronically transfer money, you should independently verify that request using a phone number you have for that individual. If you do not know them well enough to recognize their voice, should you really be sending them money?
One thing these scams tend to have in common is they try to instill a sense of urgency, and when pressed, they have excuses why you cannot reach them through your known contact methods. If you think that you would never fall for something like this, so did many of those exploited by these scams every day, totaling billions of dollars lost by people throughout the world. The estimated cost of cybercrime worldwide for 2018 was more than $600 billion; however, the true cost can never be calculated as much of it goes unreported and unidentified.
When in doubt, DON’T send it out!
As a Henssler client, should you have a cybersecurity-related question or concern, we are here to help! Contact us at cybersecurity@hensslerfinancial.com, or through your associate.
Disclosures: The investments referenced within this article may currently be traded by Henssler Financial. All material presented is compiled from sources believed to be reliable and current, but accuracy cannot be guaranteed. The contents are intended for general information purposes only. Information provided should not be the sole basis in making any decisions and is not intended to replace the advice of a qualified professional, such as a tax consultant, insurance adviser or attorney. Although this material is designed to provide accurate and authoritative information with respect to the subject matter, it may not apply in all situations. Readers are urged to consult with their adviser concerning specific situations and questions. This is not to be construed as an offer to buy or sell any financial instruments. It is not our intention to state, indicate or imply in any manner that current or past results are indicative of future profitability or expectations. As with all investments, there are associated inherent risks. Please obtain and review all financial material carefully before investing. Henssler is not licensed to offer or sell insurance products, and this overview is not to be construed as an offer to purchase any insurance products.
