October 13, 2023

Skyrocketing Email Attacks Against Small Businesses

Cyber criminals are skyrocketing email attacks against small businesses with cybersecurity measures in place.

Your digital presence is important to you as a small business owner. Your website is up and running, you’re managing your social media account, sending email marketing messages, and your team is working with email every day. Business Email Compromise (BEC) attacks are on the rise now more than ever, making it more vulnerable to cyber threats.

Email account hacks and BEC attacks increased by 81% in 2022. According to the FBI‘s Internet Crime Complaint Center, businesses worldwide lost $1.8 billion to BEC attacks in 2022 alone.

The average small business closes within six months of being hacked.

The worst part is that 98% of employees do not report email threats. The reason is that they have no one to report the incident to, as we find as a Managed IT Security Provider in Toronto. Outsourced IT management services are still available to many small businesses without a dedicated IT staff member. The vulnerability of small businesses makes them easy targets for hackers. However, do not let that discourage you from taking proactive action; rather, it should motivate you. The reason is as follows.

What Is A BEC Attack?

A BEC attack involves cybercriminals posing as business owners or trusted partners in emails, and persuading employees to perform actions that compromise the business – such as revealing sensitive information or transferring funds. Detecting legitimate emails from deceptive emails is challenging due to the sophistication and slickness of the criminals.

How To Identify A Compromised Email Attack?

Criminals have evolved their methods of executing Business Email Compromise (BEC) scams, and the guidelines below are guidelines only, not a complete list of things to look out for.
Don’t act quickly and surreptitiously when asked to make a financial transaction. It is especially important if the requests involve skirting normal processes or are coming from someone you don’t usually interact with.
Fraudulent emails: Review all email addresses associated with requests for sensitive information or financial transactions. Email addresses are frequently modified by criminals. The manipulated address could be abc_123@365tisoultions.ca, for example, if the original address is abc-123@365itsolutions.ca. It is possible to check the full email address of the sender by hovering over the sender’s name.
Requests for confidential data or logins: Be extremely cautious if you receive requests to click on a link to a login page, to update your financial account information (even if they appear to come from your bank), or to provide tax-related information.
Discrepancies in payment requests: Be alert to unexpected requests for payment that depart from your trusted supplier’s usual schedule, procedure, or contact information.
Innocent attachments and links: It’s recommended not to open attachments or links from unknown sources or if you didn’t ask for them or anticipate them.

Make your email more secure today by strengthening your security measures

The following steps will help you improve the security of your email. The advice you have heard before may not sound new to you, but if you haven’t acted on any of them yet, now is the time.

Establish financial security measures

Ensure all financial transactions are two-step verified through a policy and process. Most BEC scams can be thwarted by this simple step. A financial payment request should always be verified by two or more people. Our Managed IT Services in Toronto clients all benefit from this type of policy.

Educate Your Team

By drafting better copy, ChatGPT and other AI language models are improving email attacks by eliminating spoofed emails’ telltale grammar and language issues.

Small businesses should train their employees on how to identify and avoid BEC scams and educate their employees about the risks.

Scammers use a variety of tactics to trick employees. Email account security should be included in training, including:
Any urgent request received should be viewed with suspicion.
Taking caution when dealing with spoofed email addresses, social engineering, and fake websites.
Making sure that any strange messages are checked regularly in the sent folder.
A password with at least 16 characters should be used for your email account.
Passwords should never be used for multiple accounts at the same time.
Keeping their email password secure.
If they suspect a phishing email, they should inform their IT contact.
Authenticate domains and emails
Email and domain security tools can be set up by your IT provider within an hour or so.
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance
SPF (Sender Policy Framework)
DKIM (DomainKeys Identified Mail)
Protocols such as these help:
Make sure the email address of the sender is authentic.
Spoofing of emails can be reduced.
Prevent spam folders from being filled with your outgoing emails.
Email security with DKIM, DMARC, and SPF.
Make sure your email and anti-phishing software are up-to-date

Fraudulent emails and many BEC attacks can be identified and blocked by advanced email security solutions. They can alert users to potential threats, detect unusual patterns, and block malicious email addresses. Machine learning and AI are becoming increasingly effective, but attackers are also becoming more sophisticated.

The provision of IT security cannot be set once and forgotten, but rather must be managed on a daily basis. Small businesses can benefit from outsourcing IT services.

Money can be lost forever in a matter of seconds when you make an honest mistake. Make sure your small business emails are protected.

Cyber criminals are skyrocketing email attacks against small businesses with cybersecurity measures in place however there are options to proactively help.

Our Complimentary Network and Security Assessment can put your IT to the test against other Toronto managed IT services providers.