Click With Caution

The email looked so real.

The sender’s address looked legitimate, and the message wasn’t unusual to receive for a personal or business inbox: “You need to update your payment method on this account.” So, the recipient clicks the link, types their password, enters a credit card number, and confirms a few personal details.

It isn’t until later—when their bank flags random credit card charges—that the user realizes their mistake. They had opened their personal and professional accounts to cybercriminals by clicking a fraudulent link and then providing private data that was used nefariously and had likely been shared across the internet. The whole interaction took less than 48 hours.

Cybercriminals have come a long way since the Nigerian prince scams of yesteryear. They start with reasonable, seemingly harmless requests. Instead of “Please wire me $500K for my family,” it’s “Click here for $200 off the newest iPhone release!”

Anna Leone, senior vice president and national product development leader with Marsh McLennan Agency’s (MMA) Private Client Services, says modern cyberattacks are often subtle and reflect a better understanding of how people use their electronic devices. Machine learning and artificial intelligence have also made cyber scams much more convincing.

“It’s a lucrative business, and it’s an anonymous business,” she says.

Lock it down

Leone and Paez offer these tips for avoiding cybercrime:

• Enable multifactor authentication on everything.
• Invest in a password manager, or even multiple password managers, depending on the size of your organization.
• Monitor your family’s and employees’ internet use and ensure they’re educated on the latest scams. This can include employee awareness training, like phishing simulations.
• Have a family “safe word.” Did Grandma get a suspicious call that her grandchild is in trouble? AI can make faces and voices seem like the real thing. Asking for the safe word only known to close family members—“chocolate,” “frog,” or any other uncommonly used word—can help root out dupes.
• Identify and monitor who has access. Many organizations use privileged access management, called PAM, to limit who has access to certain accounts and activities to guard against unauthorized users.
• Use a virtual private network. VPNs protect users by encrypting data and masking IP addresses. Historically, more of a corporate measure, VPNs are gaining popularity with individuals as well.
• Have a “cyber hygiene” plan. This can begin with identifying how many devices have access to your data and networks and how often those devices have been updated with software security patches and new, complex passwords.
• Back up your data. If you are potentially exposed to a ransomware attack, you have a backup.
• Educate yourself on the latest security scams and think before you click. Independently verify the source of that link or phone number before engaging with it.
• Don’t invite in bad actors. Be careful about where you plug in your phone or laptop charger, which Wi-Fi networks you access, and which QR codes you scan. Malware is easily hidden in “free” tech.
• Don’t be overwhelmed by all the cybersecurity choices. Start small and review often, making incremental safety changes when necessary.

And remember, always think before you click!