One of the hardest concepts I’ve had to wrap my head around is that cybercriminals are smarter than I am. Hackers have taken data theft to new heights. They are organized, systematic, and patient.
Here’s a real-life scam experienced by one of my clients – a payroll company:
Their HR Manager, John, administers payroll processing. One of their employees, Mary, was going through a difficult divorce and emailed John to change her payroll direct deposit.
John had been through numerous hours of cybersecurity training. He knew that the company’s policy was that requests for any type of account change required a secondary verification. So, he called Mary and verified that she had requested the change. Mary confirmed that she had, and John processed the change.
That should have been the end. But it was just the beginning.
Weeks later, they discovered that hackers had been reading Mary’s emails for months. When they saw the request for an account change, they intercepted the email and changed the account information, then delivered the revised email.
When John called Mary for confirmation, he did not think to verify the data itself – he just confirmed Mary had sent it.
Who is at fault?
Everyone? No one? Is this covered by insurance? If so, who’s insurance – Mary’s, John’s, the Payroll Company’s? You can see how complicated things can get.
In this case my client was not able to recover the money. But you can bet they immediately revamped their internal policies. They also added Social Engineering Fraud insurance coverage to their liability policy.
The big takeaway: Every business is vulnerable.
Even if you have taken security measures in the past, it is essential that you regularly review and revise your protocols and procedures. When it comes to protecting your business, the old adage holds true: “An ounce of prevention is worth a pound of cure.”
The highest compliment our clients can give is the referral of their friends, family and business associates. If you know of someone who would appreciate our services, please let us know and we will be happy to help them. Thank you for your trust.
