The last few weeks of 2023 and the first few days of 2024 saw a significant increase in email, text, and phone-based scams. These persistent threats prey on unsuspecting consumers and businesses, arriving in the form of fake notifications from banks, credit card companies, shipping services, and e-commerce sites.
This type of illicit behavior surges around the holidays, when people spend more time shopping online, tracking shipments, and checking financial apps. The FBI reported more than 12,000 reports of non-payment or non-delivery scams during November and December 2022, resulting in nearly $75 million in losses.
Shockingly, that’s only 2% of the total losses reported from email scams in 2022—a whopping $2.7 billion, according to the FBI. And you have to multiply that number by 10 to get $27.6 billion, the total amount of losses from internet crimes between 2018-2022.
What can you do to spot common scams, understand the strategies that hackers use, and protect yourself, your data, and your systems? CMIT Solutions is here to help with the following information and recommendations:
- Watch out for phishing attacks. Phishing remains one of the most prevalent types of email scams. Phishing involves scammers masquerading as trustworthy entities to extract sensitive information from unsuspecting users. These deceptive emails often mimic well-known institutions, financial organizations, or even colleagues, tricking recipients into divulging passwords, credit card details, or other confidential data.
- Understand business email compromise. BEC attacks specifically target businesses by breaking into the email accounts of executives or employees. All it takes is one scammer gaining unauthorized access to one email account to wreak far-ranging havoc but using that inbox to send fraudulent requests for money transfers or sensitive company information. BEC attacks often involve extensive research on the targeted organization, making the emails appear highly convincing.
- Beware of urgent messages about shipping notifications, bank charges, or financial transactions. To add authenticity to phishing or BEC attempts, scammers may craft emails with urgent language, creating a sense of urgency to prompt quick responses These are particularly common in emails or texts purporting to come from the USPS, UPS, or FedEx requesting address confirmation or package pick-up. Hackers also try to impersonate financial institutions, real estate companies, tax departments, and other governmental agencies.
- Never click on unfamiliar attachments. The second step of all these different types of scams involves sending emails with seemingly innocuous attachments and asking users to open them. Once that action is taken, these illicit attachments can unleash malware or ransomware, compromising the recipient’s device or connected network. The goal is typically to encrypt files and demand a ransom for their return, steal sensitive data for identity theft purposes, or exploit infected systems for unauthorized access.
How Else Can You Protect Your Information?
- Double-check email addresses. If you’re not sure about the authenticity of a message—especially if it requests sensitive information or financial transactions—check that the sender’s name matches the email address. Legitimate entities will use official domains, but scammers will try to spoof a legitimate email address with a slight misspelling or suspicious variation. The addition or removal of a single character in an email address may be difficult to spot at first glance:
- example. vs. example.corn: In this case, the scammer replaced .com with .corn, with the letters “r” and “n” replacing the letter “m.” This change can be hard to detect on most computer screens.
- Officialemail@business.com vs. 0fficial.email@business.com. In this example, a hacker will use a zero instead of a capital O and add a period in the address to spoof an official contact.
- Think before you click. Users should NEVER open unfamiliar attachments or click on uncertain links from unknown or unexpected sources. This goes for text messages delivered via smartphone, too. If in doubt, contact the sender directly to confirm the legitimacy of the email and the attachment. Hover over links in the body of an email to preview the URL before clicking, or manually type the desired web address into your browser bar. If a notification arrives via text from a major company like Google, Microsoft, or Amazon, log in to the associated app to check for security alerts before clicking a link in a text.
- Employ advanced email security solutions. A trusted IT provider can help your business with tools that automatically detect and filter out malicious emails. These solutions combine AI, machine learning, and human oversight to analyze email patterns and identify potential threats before they arrive in your inbox. Quarantining suspicious emails allows attachments and links to be checked before a user has a chance to accidentally click on them.
- Enable multi-factor authentication for all accounts. Your business should implement MFA, which requires something users know (like a password) and something users have (like a unique code delivered via text or email), whenever and wherever possible. This adds an extra layer of security to login credentials—even if scammers manage to steal a password or infiltrate a connected machine, the additional verification step of MFA can prevent them from further damage.
- Educate and empower employees. Instead of hoping for the best and avoiding talk of popular scams, provide updated training and awareness exercises to empower everyone. Regular sessions that simulate the latest email scams can work wonders on employee confidence and intelligence, emphasizing the importance of skepticism in the face of a deluge of scams and proper verification procedures everyone can take to protect accounts and information.
Regularly update systems and software. If you’re not working with a trusted IT provider to complete this critical task, contact CMIT Solutions today. We help users and businesses protect every component of the IT ecosystem by deploying software updates and security patches to operating systems, hardware and software, productivity apps, email platforms, printers, routers, and much more. This prevents hackers from exploiting known vulnerabilities or legacy applications that are no longer supported by software companies.
As email, text, and phone-based scams increase, 2024 is the year to stay informed and implement practical defenses against common cyber issues. CMIT Solutions helps businesses across North America to fortify their defenses against scams of all kinds. Vigilance and proactive cybersecurity measures can thwart the attempts of cybercriminals and preserve the integrity of personal and business information in this transformative digital age.
Have questions about email protection, cyber defenses, and business security? Contact CMIT Solutions today.