Cybercriminals target employees through phishing emails designed to capture an employee\u2019s login credentials. Once the cybercriminal has obtained an employee\u2019s credentials, the credentials are used to access the employee\u2019s payroll account in order to change their bank account information. Rules are added by the cybercriminal to the employee\u2019s account preventing the employee from receiving alerts regarding direct deposit changes. Direct deposits are then changed and redirected to an account controlled by the cybercriminal, which is often a prepaid card.<\/p><\/blockquote>\n So, what\u2019s going on here and how can you make sure you, your coworkers and\/or your employees don\u2019t fall victim to it?<\/p>\n Let\u2019s hash it out\u2026<\/span><\/p>\n We have come a long way since the days where Nigerian royalty would email you a poorly written plea for interim financial assistance in return for a larger payday down the road. Granted, those do still exist. I\u2019m not sure if that\u2019s just a continued shot in the dark or at what rate that scam ever converted, but it must not have been that good because phishing has evolved considerably over the past decade.<\/p>\n And they know what they\u2019re doing. They know that a company\u2019s own employees are often its greatest threat<\/a>. They know that 70% of US employees don\u2019t have a clue about cybersecurity best practices<\/a>. They\u2019re sending a high volume of these emails, too. 1 out of every 101 emails sent is malicious<\/a>. The average US employee receives 16 malicious emails per month<\/a>.<\/p>\n The point is this: cybercriminals know how to disguise their attempts to steal your data and defraud you. They have a lot of experience doing this and the stakes are low enough (there is little risk inherent) that they can be prolific in their attempts, too.<\/p>\n![\"FBI:](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/09\/bigstock-Phishing-Scam-Danger-Sign-81254717-300x300.jpg\")
So far cybercriminals have targeted a number of different industries with this scheme, most prominently the healthcare<\/a>, commercial aviation and education sectors.<\/p>\nSocial Engineering and You<\/h2>\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/09\/bigstock-Happy-Retro-Guy-Pointing-Over-17343053-240x300.jpg\")
Nowadays cybercriminals leverage social engineering<\/a> to create highly personalized emails that are intended to create a sense of urgency<\/a>. Criminals have been known to scour LinkedIn<\/a> and other social networks for information that can be used to make an email seem more convincing. This practice has become so refined that they\u2019ve even nailed down what words<\/a> most often illicit the desired action.<\/p>\n
![\"FBI:](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/09\/bigstock-Man-On-The-Phone-Retro-Clipa-17346638-300x240.jpg\")
Also, and this is the most important, if there\u2019s ever any doubt about the legitimacy of an email, contact the supposed sender directly via something other than email. Unless you’re just racked by social anxiety, call them. If the email is legitimate they\u2019ll tell you. If it\u2019s not \u2013 and they have no idea what you\u2019re talking about \u2013 you\u2019ll know you\u2019re being phished.<\/p>\n![\"Hashed](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568.jpg\")
<\/p>\n\n","protected":false},"excerpt":{"rendered":"