The evolution of digital fraudsters

Mehmet Goksen at Conflict International ask how can you protect your business from cyber-criminals

 

At least once in the past, you will have received an email excitedly announcing that you have won a fortune in a foreign lottery or have been bequeathed a huge sum by an unknown and recently deceased relative. It typically offers large amounts of money in exchange for a small payment into an offshore bank account.

 

These emails have become so familiar that the very concept has become something of a joke within society, playfully indicating the gullibility of the subject.

 

The scenarios and sophistication of language varies from email to email but what remains the same is the fraudsters’ motive – encouraging you to part with your cash and banking details to seize control of your accounts.

 

People have evolved alongside technology and combined with new controls introduced by banks and tech companies, society has become more resilient to these attacks. This hasn’t reduced the number of attempts, rather it has meant that more emails and therefore more time and money, needs to be expended per $1 gained from the fraud.

 

This has prompted fraudsters to upgrade their style – and the new approach is costing people in the UK millions.

 

The numbers don’t lie – flourishing fraudsters

With the ONS reporting that the overall level of fraud has returned to its pre-pandemic level of 3.7m recorded offences last week, it is clear fraud remains a persistent and growing threat to UK businesses.

 

Despite bank and credit account fraud falling by 14%, Advance Fee Fraud (AFF), where the fraudster extracts payment from the target on the promise of greater payments in return, increased by nine times. 

 

UK Finance reported that Authorised Push Payment (APP) fraud increased by 30% on pre-pandemic levels in the first half of last year and continues to be a major cause of concern.

 

APP fraud is a step above AFF in terms of complexity and sophistication as it involves a significant amount of social engineering per attack, with scammers often preparing weeks or months in advance, using phone calls, social media posts and even fake websites to manipulate victims before striking.

 

We’ve seen a significant spike in this type of investigation occurring and the trend it points to is troubling. Following the COVID 19 lockdown, our purchasing behaviours and working patterns shifted, and although, lockdowns are a thing of the past, the uptick in online transactions is being capitalised on and exploited by scam artists around the world.

 

Preparation is king for protection

The picture being painted by these facts appears bleak. So, what can we do to protect ourselves and our businesses from this army of scammers? As modern tactics are focussing on social engineering, IT firewalls and other technical controls fail to be effective.

 

The good news is there is much that can be done to repel these attacks and keep the fraudsters at bay. Focussing on the high growth areas of AFF and APP, the critical controls that can manage down these risks must involve training and awareness on how to identify and respond to suspicious communications.

 

If you suspect, for example, that an email does not come from who it claims to come from, one recommended way to confirm this is through two factor authentication. Reaching out to the claimed author using a separate means of contact will certify the validity of an email i.e., calling a supplier on the phone.

 

For businesses, training should be refreshed and redelivered on a regular basis to reflect the evolving nature of threats in the environment we face. Training on its own however, can’t cover every possible eventuality and even if it could, it would place too great a responsibility on individuals to remember and execute perfectly in every situation.

 

This is why businesses must supplement their training regime with a comprehensive and robust information security policy and procedure framework which is immediately accessible by employees and appropriate for the business in question.

 

Businesses should upskill all employees to successfully identify suspicious communications and, at the very least, have accessible support.

 

If you suspect you have been a victim of fraud, you should report it immediately to the police or Action Fraud and your bank. Unfortunately, police resources are spread extremely thinly which negatively impacts the chances of investigations even being launched much less concluded successfully. This may well be one of the reasons we have seen a spike in requests for APP fraud investigations.

 

A call for new approaches

In the future, this arms race between authorities and fraudsters will continue to evolve. We can expect to see a continued growth in digital fraud simply because so much time is now spent online. One interesting development involves the Government changing the rules to make it easier for defrauded individuals to be reimbursed by banks.

 

Given the cost-of-living squeeze, we may actually see a growth in fraudulent claims submitted to banks, or even individuals working hand-in-glove with fraudsters to fabricate losses.

 

Individuals and businesses must be vigilant and proactive in their financial and information security practices. Fraudsters are becoming increasingly sophisticated. It’s no longer a case of firing out a million emails to trick a few individuals but profiles are now being built to tailor digital communication to the target to be as convincing as possible.

 

Just as the criminals have upped their game, we need to step up too

 

---

 

Mehmet Goksen is Head of Corporate Development and Compliance at Conflict International

 

Main image courtesy of iStockPhoto.com