There are many reasons why scammers do what they do. One of their main motivations is money, but in the case of ransomware, data breaches, or virus attacks, sometimes the motivation is revenge. Based on the industry and the type of cyber attack, you can hazard a guess on the scammers’ goals.
Online cyber-attacks can now take place on your mobile devices, and as most mobile devices do not come equipped with any comprehensive data protection, anti-spyware, or antivirus software, they make easy targets for scammers. 70% of scams are now mobile-friendly with a 680% increase in fraud originating from mobile apps.
IBM Security’s annual X-Force Threat Intelligence Index for 2020 reveals the top industries targeted by scammers. Not surprisingly, financial and insurance services are number one. What is surprising is the number two industry. It seems once there is an opportunity, scammers will seize the chance to steal your data and blackmail you for money.
In the top five industries targeted by scammers, there seem to be consistent methods of attack. Through phishing and hacking, scammers have perpetrated ransomware attacks, credential harvesting, remote access scams, and data theft.
Financial and Insurance Services Industry
The financial and insurance services industry consists of financial planners, wealth management firms, investment advisers, stockbrokers, superannuation providers, and investment advisers, agents, brokers, and companies. The businesses in the financial and insurance services industry provide financial advice, buy, create or sell ownership of financial products, regulate financial activities and provide insurance and pension plans.
Naturally, being the hub of the world’s finances, you would attract unsavory attention. The finance and insurance services industry has been targeted by scammers for decades, way before the invention of the internet. Now with the emergence of Fintech and COVID-19 pushing more banking and financial services online, customers and financial services are being targeted more by online scammers.
Skimming and counterfeit cards are a constant threat to customers and bank officials in the banking sector. Data theft and ransomware attacks are also prevalent in the financial and insurance services industry, so one would think that the number one type of scam in the financial and insurance sector would be an investment scam or credit card fraud. And though credit card fraud is a real threat to the banking sector of the industry, it isn’t the main culprit of the financial and insurance services industry.
Remote Server Access Scams
Remote server access scams, or tech support scams, are sometimes done through phishing or spoofing emails that claim to be tech support requesting access to your server. In other instances, they can be pop-ups on your computer claiming to detect a virus and requesting access to help.
They can come off as being aggressive and rude with the intention of mimicking tired and disgruntled tech personnel, telecommunications companies, tech companies like Microsoft, or your own local technical service provider.
Remote server access scammers may even call you and say you or someone in your department requested technical support or your device needs a software upgrade and request a software download. Once inside your server or device, scammers can steal your data, install viruses, or further request your credit card information.
Firstly, you should note that finance and insurance companies don’t request credit card information or a phone call to solve a problem. They will enact system diagnostic and repair programs first. Second, nobody from any company is supposed to cold call you to check any system. And whether the system needs repairing or not, it’s not going to matter to the tech. If they seem overly concerned and desperate to fix it, then it’s probably a scam.
To counteract remote server access scammers, learn to verify the identity of the caller first. Request their full name and credentials then tell the potential scammer you need to verify their credentials before giving access. Make sure your device has an updated firewall, anti-spyware, antivirus protection, and IDMaml for ID validation and fraud protection.
Manufacturing Industry
The manufacturing industry consists of companies that transpose raw goods, components, and ideas into products and services. It includes car manufactures, textiles, industrial components, shipbuilding, paper products, chemical industry, aerospace, food and drink manufacturers, and more. Like every other industry on this list, the manufacturing industry has been forced to become more agile and digital due to Covid-19. As a result of more people working from home, scammers took the opportunity to take advantage of communication gaps. As an industry that is heavily focused on machine production, scammers have found a loophole in their technical expertise. No doubt managers and CEOs of large manufacturing plants didn’t foresee the need for protection because they believed that the only thing they have that can be stolen is right there on the factory floor.
Considering data theft and ransomware attacks account for 35% of the scams in the manufacturing industry, it may be safe to say they are considering data and system protection now. One particular scam in the manufacturing industry shows just how subtle and normal a scam could be.
Business Email Compromise
In Business Email Compromise (BEC), also known as Email Account Compromise (EAC), the scammer uses a phishing or spoofing attack by sending emails seemingly from within your company’s business contacts or your finance department. The scammer can take days and even weeks to garner your trust before demanding payment or requesting information. After all, they know the industry you are in, so they know the day-to-day demands and how to invoice payments work.
In BEC, the scammer can also use malware attacks and data breaches to gain access to your system then request account information. They request things like:
- Invoice payments with updated accounts and mailing address
- Business expenses for a department and account access to make payments
- Down-payment on a loan or mortgage with directions to the account
- Payment for PPE supplies due to COVID-19
A BEC scam email is always made to appear legitimate on the surface. With COVID-19, scammers took the opportunity to tweak the scam for both business and their customers. They created scam kits made to mimic cloud-based email services that manage shared calendars, emails, online storage, and instant messaging.
According to the FBI’s 2019 Public Service Announcement, the BEC scam targets small, medium, and large companies as well as personal accounts. The BEC scam has been reported in all 50 US states and across 177 countries. Fraudulent transfers have been sent to at least 140 countries and account for over 26 billion USD in losses between 2013 and 2019.
To keep you and your company out of a compromising position from being targeted by scammers, you can start by paying attention to the sender’s address. Some email addresses are not as legitimate as they seem. Change logins and passwords frequently and enable alerts for suspicious logins. Perform ID validation and verify sender’s device and identity with identity verification solutions from IDMERIT.
Energy Industry
You probably think oil, gas, wind, water, and solar power are hardly worth being targeted by scammers unless it was an investment scam. Like the manufacturing industry, the energy industry wasn’t that big on scams in 2019, but in 2020 scammers found loopholes that left them susceptible to BEC, ransomware attacks, and their number one problem, data theft.
Most of the energy industry infrastructure isn’t designed to handle data theft or hacking attacks. However, the industry has a broad playfield from which hackers can play through. Through hacking, outside parties have even gained access to operational technology controlling wind turbines and stopping them or causing destruction. Hackers can shut down gas companies, power grids, and even electric vehicles.
Data Theft
In the 2020 report on data breaches in the energy industry, it was found that energy industry employees were using corporate accounts to register for entertainment, retail, and gaming sites. Though not expressed in the report, no doubt this practice exposed some of the company’s credentials and data to some unscrupulous parties.
Although data theft is common across most industries, the energy industry was struck particularly hard with the largest share of 35% of their attacks being from data theft.
There are three reasons why this somewhat obscure industry suffers data breaches:
- To cause security and economic disruption,
- To access data that can be converted into monetary rewards
- To protest the actions of the companies in the industry and expose their agendas
Customers of the energy industry fear no better from data theft from a few bad apples in the industry. These bad actors or sometimes fake utility company representatives use customer data in utility scams. In this scam. customers may be asked:
- For credit card information for a refund
- To pay an overdue bill
- To grant access to your home or business to perform utility checks
- To send private information via phishing and spoofing emails
Once you do that they can run up charges on your utility bill or steal your identity altogether.
Protection against utility scams as a customer is easier than protecting the energy company from data theft. Energy companies can protect their customers by making it easier for them to validate the identity of employees and emails from the company. They can also use proper employee and customer onboarding with safe identity validation solutions, like IDMscan that can perform ID validation for customers and employees’ IDs in seconds.
Right now, the energy industry is discussing ways to reduce its susceptibility to data theft and system breaches. Hopefully, some of these changes will include ID validation and identity verification service like IDMconnect that can make it easier to verify customer utility records.
Retail Industry
The COVID-19 global pandemic lockdowns brought record levels of online commerce in 2020. Working from home and stay-at-home policies drove increases in online shopping attracting unwanted attention to the retail industry from cybercriminals.
The retail industry in recent years now includes e-commerce platforms like Amazon, eBay, and other major retail stores that created e-commerce versions of their brick and mortar stores.
Server access and ransomware became rampant as cybercriminals found opportunities within the retail industry. Once they realized there was money to be made, they turned to credential harvesting.
Credential Harvesting
Credential harvesting, also known as password harvesting, is targeted towards gaining an employee’s login information. Some experts believe it is the basis of some phishing and spoofing scams. Credential harvesting is the gathering of compromised user credentials including user names and passwords.
Besides phishing and spoofing emails, credential harvesting is done through fraudulent links and downloads, and it steals your employee’s information without them knowing it. Once the scammer has the information, the fraudulent person can then use it to access sensitive information or sell the information to other scammers.
To reduce your risk from credential harvesting, use multi-factor authentication and IDMERIT’s identity verification solutions with behavior monitoring to assess risk-based access control based on analysis of user behavior.
Professional Services Industry
The professional services industry market share is worth over 5 trillion USD globally and includes a wide range of occupations such as lawyers, accountants, designers, consultants, B2B business services, and other services that help clients manage, support, and grow their businesses.
The professional services industry is plagued by scams, such as non-payment scams, fake jobs, billing fraud through phishing and spoofing, data theft, and remote server access attacks. However, one particular type of cyber attack stands out from the rest.
Ransomware Attack
Ransomware attacks involve gaining access to your device through downloading malware from links and email attachments from unknown sources. Once there, the scammer encrypts your device and demands a ransom for the decryption key. Paying the ransom doesn’t always guarantee access will be restored to your personal or business data. It accounts for 35% of cyberattacks in the professional services industry. Here are some of the popular types of ransomware attacks.
Crypto Malware
Users of Windows OS were targeted in 2017 and payment was demanded in the form of bitcoin.
Lockers
Involve completely locking you out of your device and is targeted towards Android users.
Scareware
Claims to have found a virus and acts like an antivirus or cleaning tool demanding money for its removal.
Doxware
The scammer threatens to publish stolen sensitive information if you don’t pay the ransom.
RaaS
Ransomware as a Service (Raas) is done as a service for another party for a cut of the ransom. (yes, you read that right) They perform the scam and collect the payments all for a fee.
Due to the popularity of cell phones, scammers have even created specific attacks for their operating systems. As with the Windows ransomware scam, there is one for Mac as well. Strangely, given the popularity of antivirus software that protects against ransomware, you would think that would be enough to protect your device. Yet, ransomware attacks have increased in 2020 by 485% globally with losses totaling over 20 billion USD.
Given that the ransomware attack can be done as a service, you cannot rule out the possibility of competitive influence, disgruntled clients, or former employees as financial backers. Therefore, ensure you can perform background checks and ID validation in seconds with IDMscan. Having an identity verification solution protects your business, helps with customer onboarding and Know Your Customer (KYC) compliance.
Closing
There is now cyber insurance available for when you get scammed because most experts believe it’s only a matter of time before you or your company will be faced with identity theft, data theft, or some other online scam. As great as the idea of insurance is, assurance that the attack won’t happen in the first place is better.
Setting up the proper ID validation systems or an identity verification solution to verify and validate the credentials and devices of parties trying to access your systems can be a better deterrent against cyber attacks. Data breaches can immediately decrease your stock price by .45%, going steadily downhill over time and unless you are in the financial and services industry, it may take quite a while for it to recover.
Incidentally, every cyberattack involving phishing and spoofing or other data breaches puts your company at risk for Counter-Terrorism Financing (CTF), KYC, and Anti-Money Laundering (AML) non-compliance. So if you can’t protect your customers’ and employees’ information, your company will be liable for fines.
Don’t be targeted by scammers. Stay compliant with IDMERIT identity verification solutions and protect your company’s device from ransomware, data breaches, and phishing and spoofing scams which are prevalent throughout all industries.
