‘Tis the season to be jolly! Or is it?

As the festive period comes round once more, as a security expert, you’re more than aware that your organisation could well be being targeted by ever inventive email phishing scams. And you’d be right. According to the National Cyber Security Centre (NCSC) and Action Fraud, more than 16,000 unsuspecting Brits lost a collective £11.5m to cybercrime during November & December last year. This year is likely to be even higher.

Over the past month, we’ve also seen a noticeable upturn in phishing traffic caught by our inbound DOQEX gateways. Some of it obviously fake, some less so. Here’s a quick run-down of the most popular email cons doing the rounds this winter: 

Fake eCards: 
Scammers are well-versed in sending legitimate-looking eCards that once clicked begin downloading adware, spyware, or trojan viruses onto a computer. 

HMRC and Tax Notifications
Especially prevalent after the recent budget. We’ve seen plenty of spear-phishing at Finance officers looking to collect credentials about corporate accounts.

Christmas bonus scams: 
Scammers will send fake emails that appear to be from the HR team or a known contact, offering a Christmas bonus or similar corporate benefit. These emails often include links to malicious websites. 

Fake Delivery Emails
Probably the most popular and prolific scam around, Christmas is a time of high parcel deliveries. These ‘missed delivery’ style emails appear to originate from the delivery/courier company, and once a link within the email is clicked will either take them to a phishing website or infect their computer with malware.

Internal communication scams: 
Be wary of “personal” notes from the CEO or any other senior manager/director, especially when they are requesting sensitive data or contain links (again, possibly to malicious websites). 

Fraudulent job postings: 
Another popular ruse is that of fake seasonal job postings. Scammers have been seen to create fake LinkedIn profiles and other accounts, to further dupe unsuspecting visitors that they are authentic, and their offers are genuine.

False charitable requests: 
This is a seasonal favourite! Being sent emails or text messages soliciting charitable donations for a well-known good cause, with any links being directed to a fake (albeit identical looking) website and payment system. 

Like you, we continue to remind users to be aware of these and other scams and recommend that they: 

Be wary of unexpected attachments in your emails: 
Even confirm with the sender before opening any attachments, particularly if they claim to be holiday e-cards or contain urgent messages. 

Check the sender’s email address: 
The devil is in the detail. Phishing emails often use slight variations or misspellings of genuine url addresses. 

Hover over links: 
Hover over links in emails to preview the actual URL. If it doesn’t correlate to anything you know, it could be dangerous.

Implement multi-factor authentication: 
Recommended by the National Cyber Security Centre (NCSC), this extra step adds an even greater layer of security. 

Remind email users of seasonal scams: 
It’s never a bad idea to remind staff and colleagues on how to recognise and be aware of seasonal phishing scams, and what to do if they discover one. 

Implement email authentication protocols: 
Set up and use DMARC (Domain-based Message Authentication, Reporting & Conformance), as it can help filter out fraudulent emails. 

Finally, it wouldn’t be Christmas without a terrible Christmas cracker joke…

Q. What’s a hackers’ favourite Christmas food?

A. Spam!