We’ve heard more than a few horror stories in the past few months of business owners falling for phishing scams that compromise their company, cost them thousands of dollars, and put their customers and contacts at risk. Hackers are getting more sophisticated by the day, and it’s becoming harder to tell a malicious threat from an ordinary email.
We share this insight to empower, not scare. The good news is that most threats are avoidable with a vigilant eye. In 2021, think of a phisher as more of a vampire than a heister: you have to invite them in before they can cause any harm. Below, we’ve pinpointed a few common threats for 2021 and 2022, along with best ways to avoid them. These suggestions should help keep your sensitive data secure from current phishing trends.
Common Threat 1: QuickBooksⓇ Impersonation
One common trend we’re seeing involves solicitations from QuickBooksⓇ impersonators falsely notifying you that your QuickBooksⓇ file is corrupt, your automatic payment is about to expire, or your version of QuickBooksⓇ needs to be updated. These phishers will try to get you to pay for a phony upgrade over the phone or grant them access to your desktop to “fix” your accounting software. Here’s the thing: if you work with an accounting company like New Business Directions, we’ll probably be the first ones to know if something is wrong with your QuickBooksⓇ file. And if you’re a New Business Directions customer, QuickBooksⓇ knows you’re working with a QuickBooksⓇ Solution Provider and will often notify us of any issues your account may be experiencing, too.
How to dodge the threat: If an email appears to come from QuickBooksⓇ, check the email addresses for the correct website. If it doesn’t end in “@Intuit.com” or “@QuickBooks.com” the sender is fraudulent (even if the name before the @ symbol looks convincing). Always contact your accountant before engaging with a solicitation like this and never provide payment information or authorize remote access to your computer or QuickBooksⓇ file to anyone besides your accountant or IT solutions provider.
Common Threat 2: Download this Attachment
Another major threat to watch out for involves an email from an address you recognize (say, a customer, vendor, or team member), but asks you to enter your Microsoft credentials to view the attachment. This scam comes from a person you know, and their email address matches the one you have on file. The MicrosoftⓇ log-in screen looks legit, but the web address is not. Do not enter your Microsoft credentials. As soon as you do, the hackers have access to your email and all sensitive information you have ever sent or received via email. The phishers will then send the exact same email that you fell for to every contact in your address book.
How to dodge the threat: never enter your log-in credentials to view an attachment. If an email includes a hyperlink, hover over the link with your mouse (don’t click) and watch for a link preview to appear in the corner of your screen. In Outlook, this will be the bottom left corner. You’ll be able to see a preview of the web address the hyperlink is trying to send you to, and if it’s different from the one typed out in the email. In this case, if the domain isn’t “office.com” the email is fraudulent. This is a fast and simple step you should always take before clicking a hyperlink in an email. And when it comes to sharing sensitive information like bank statements and government IDs, you should always use a secure, encrypted file sharing application like SmartVault instead of sending the document as an email attachment.
Common Threat 3: “You Have a Voicemail” emails
Are you surprised to be receiving an email notifying you about a new voicemail? Does it have an attachment? Is the sender posing as RingCentral or another VOIP phone system provider you use? Remember: if it seems suspicious, it probably is.
How to dodge the threat: don’t download the voicemail. If you want to be sure you’re caught up on your voice messages, navigate to your voice mailbox the way you usually do and avoid interacting with the email in question.
Common Threat #4: The QR Code Swap
QR codes have become so mainstream that we interact with them weekly, if not daily. From restaurant menus to sign up forms, they make accessing the information you need quick and simple. But there are emerging trends in which bad actors will replace a QR code with their own – by overlaying a sticker. They may also come in the form of seemingly-legit emails. But as soon as you scan these phony codes, you could be putting your sensitive data at risk or downloading malware.
How to dodge the threat: Review the preview of the web address when you scan the code, and before you click on the link that appears. Make sure it’s spelled correctly, and seems like it’s coming from the correct person or business. When dealing with QR codes that exist in a public space, take a second glance to make sure the QR code hasn’t been tampered with, such as replaced by a sticker. When in doubt: don’t scan that code!
Best Practices
There are so many ways to avoid phishing scams, but the most important thing to do is stay observant. If something seems off about an email, it probably is. Below, we’ve outlined a few specific best practices that should help you avoid scams:
- Set-up two factor authentication. Do this for all websites/applications you have log-in credentials for. It might seem inconvenient to go through one more step to access your online accounts, but this practice is still more convenient than dealing with a successful cyber security attack. Apps like LastPass Authenticator or Google Authenticator are an option. These apps provide a six-digit code for you to enter once you’ve logged in to your desired online account. Many other web-based companies offer the option to have an authentication code sent to your personal cell phone or the email associated with the account. How does two factor authentication help? Even if a phisher gets your credentials, they still need access to your email, text messages, or authenticator app to get the authentication code and hack your account, making it significantly less likely they’ll be successful in their attempted breach.
- Keep up with phishing scam trends. Check for updates from Forbes.com, PCMag.com, or your favorite trusted business news source for updates on phishing trends and recent cyber security threats.
-
- Don’t open the door for strangers. Never grant access to your computer to someone you don’t personally know, even if they look like a QuickBooksⓇ rep. Your accountant and your IT Support vendor/employee are the only people you should ever allow access to.
- Watch for inconsistencies and typos. Are there misspellings in a marketing email? Does the subject line have five exclamation points? Is your name or the name of your company spelled wrong? When it comes to emails, if it smells like a phish and looks like a phish…well, you know the rest.
- Double-check the sender. Always check the sender’s email address. If the name associated with the email address says “Rhonda Rosand” but the email address differs from the one you have on file for Rhonda Rosand, the sender is a fraud. In cases like this, you should check with the individual through another previously established method of communication, be it a phone call to a number or email you already have on file to confirm your contact actually sent the email you’re looking at. Don’t reply to the questionable email with, “Rhonda, is this really you?” If you were a hacker, how would you respond to that email? Red flags include a professional email that includes an @gmail.com (or similar) domain, a slightly misspelled name, or a domain that differs from that of their company’s website.
- Train your Team. If you received a sketchy email, chances are your team received it, too. Send out an all-company message about the threat and tell employees to notify you or your IT professional immediately if they interacted with the threat. Share trends in cyber security threats, and host frequent training on cyber security best practices.
- Trust your gut. Even if the sender looks familiar, if they’re asking for weird information or are trying to send you an attachment in an unusual way and it seems suspicious, trust your gut. Look for other clues that they might be an imposter: is a hyperlinked web address different from what it should be? Is their email address different from the one they typically use? Is their tone or communication style different than usual?
- Keep your passwords strong and secure. LastPass is a great solution for dual factor authentication, generating complex passwords, and storing sensitive information securely. You can read more about this helpful cyber security solution in a recent blog post of ours here.
- Don’t send sensitive information via email. Avoid sending credit card information, banking information, W-2s and 1099s, pictures of vital documents like drivers licenses, social security cards, etc. via email altogether. Instead, use a secure document management system both parties are already aware of.
When in doubt, don’t click that sh!t
When it comes to Cyber Security, It’s always better to be safe than sorry. Be suspicious of communication that seems a little off. Avoid unusual emails and contact your IT security provider (or accountant, if it’s related to accounting) to ask for their insight right away, especially if you’ve already accidentally interacted with the phishing attempt. New Business Directions is well versed in phishing scams, and we have a keen eye for malicious emails. If you’re a current customer and feel unsure about an email or solicitation you recently received involving your accounting software, reach out to us.