Consistent Positive Reinforcement to Fight Phishing Scams
Are you doing enough to prevent phishing scam attacks? Find out why email scams are so dangerous and how positive reinforcement can support security goals.
When we consider the billions what email phishing scams are now costing businesses, We’re taken aback. The FBI took complaints worth nearly $3,000,000,000 in 2018, of which only a bit over half could be recovered. Many other micro-transactions, five hundred here, five thousand there, likely go unreported. These are mostly small businesses that just pay up and feed the organized criminal syndicates, making it very worth their while.
And these criminals have taken to turning our employees into weapons against us with intelligent email scam strategies like social engineering. It doesn’t matter how reliable your virus protection is when criminals employ tactics that reach your employees directly.
We see things like this happening to businesses every day. A manipulative person/group uses social engineering against a loyal employee. It’s sickening. And that’s why we’re not alone in saying we need to take a different approach to business security. And positive reinforcement may be the answer.
Why Social Engineering Is a Massive Threat
Social engineering refers to how people are raised to conform to various social constructs. Learning to say “please” and “thank you” or trying not to “hurt people’s feelings” are examples of social engineering.
Many have been conditioned to respect people in authority. When someone in authority tells a person to do something, they may not question.
Put yourself in their shoes for a moment. What if you were a front line employee who got an email from the CFO of your company. The email looks 100% legitimate, and the “CFO” makes it seem urgent. Would you follow their instructions? Would you be afraid you’d get reprimanded by your boss if you don’t? Would you question whether that’s the CFO?
You may say: I’m too smart to fall for it. But know that scammers do their homework, recreating letterheads, signatures, email addresses, and websites to make everything look real.
Imagine Microsoft, a trusted brand, sending an employee an email letting them know that their Microsoft Office 365 account has been compromised, and they need to log in immediately to change their password through this email link. Except there was no compromise, that is unless this employee takes the bait.
Social engineering is so powerful because it taps into our automatic responses. Most people want to trust. They want to follow instructions. They don’t want their boss to be unhappy if they don’t.
This is what we’re facing.
Building Better Security
As a business leader, do I need virus protection and firewalls? Certainly. But I have to think more comprehensively. And since these criminals are attacking my employees directly, a company’s employees must be part of the solution.
We need to not only educate employees but also engage them in a comprehensive solution that includes:
- Advanced Cybersecurity. This consists of a wide array of tech solutions like improved spam filters, so fewer employees see these emails.
- Two-step authentication. Make employees think twice about what they’re doing by putting a small hurdle between them and what they plan to do. This may involve the sign off of two people as well.
- Monitoring for suspicious activity You don’t have to invade employee privacy to set up a system that monitors for keywords like “Western Union,” “Wire,” etc.
- Rewarding employees. Have a system to reward employees who report possible scams to your IT department. IT should have a clear plan to manage these risks. Please make a note of the fact that an employee reports suspicious emails in their reviews.
- Corrective action, per your policy. Be careful not to punish employees who refuse to do something because they’re trying to protect the company.
- Regular training and reinforcement of policies. Help employees understand the power they have to stop these attacks from damaging the company a jeopardizing their career. Please encourage them to question everything.
Protecting Your Business
Scams like these aren’t going away, and they’re only getting smarter, more frequent, and organized.
Pulse Technologies provides IT services and IT support in SW Florida, Puerto Rico, and US Virgin Islands. I can help you combine the power of cybersecurity technology with the human resources you have within your company to protect what matters. Contact the Pulse office to schedule a consultation today.
Experienced Chief Executive Officer with a demonstrated history of working in the information technology and services industry. Skilled in Customer Relationship Management (CRM), IT Service Management, Team Building, IT Strategy, and Management. Strong entrepreneurship professional with a Master of Business Administration (M.B.A.) focused in Computer/Information Technology Administration and Management from Humboldt University of Berlin (Humboldt-Universität zu Berlin).
