Phishing email and fraudulent website

  Don't believe in such email as below; Don't just see the name of the sender, check the sender's email address:

If you fall for it and click the link will take you to:

IT LOOKS LIKE THE OFFICIAL CYPRUS POST OFFICE

Take a look the the URL  https: // cyprus- inc -cy. com/ user/ d8b6d

and DON'T FALL FOR IT

Malware vs Viruses: What’s the Difference?

Understanding the difference between malware and viruses is very important. A virus is just one type of malware, but the term is more widely used by the public. The term malware refers to any malicious software, including a computer virus. For example, between 2000 and 2005, spyware and adware emerged as types of malware that protection systems had to deal with.

Malware is infecting computers and mobile devices at an increasingly greater pace.

What is a Malware?

Malware is software written specifically to harm and infect the host system. Malware includes viruses along with other types of software such as trojan horses, worms, spyware, and adware. Advanced malware such as ransomware are used to commit financial fraud and extort money from computer users.

Common types of malware:

    Virus: As discussed, Virus is a specific type of malware by itself. It is a contagious piece of code that infects the other software on the host system and spreads itself once it is run. It is mostly known to spread when software is shared between computers. This acts more like a parasite.

    Adware: Adware is also known as advertising-supported software. It is software which renders advertisements for the purpose of generating revenue for its author. The advertisements are published on the screen presented to the user at the time of installation. Adware is programmed to examine which Internet sites, the user visits frequently and to present and feature related advertisements. Not all adware has malicious intent, but it becomes a problem anyway because it harms computer performance and can be annoying.

    Spyware: This type of malicious software, spies on you, tracks your internet activities. It helps the hacker in gathering information about the victim’s system, without the consent of the victim. This spyware’s presence is typically hidden from the host and it is very difficult to detect. Some spyware like keyloggers may be installed intentionally in a organization to monitor activities of employees.

    Worms: This type of malware will replicate itself  and destroys information and files saved on the host PC. It works to eat up all the system operating files and data files on a drive.

    Trojan:  Trojans are a type of virus that are designed to make a user think they are a safe program and run them. They may be  programmed to steal personal and  financial information, and later take over the resources of the host computer’s system files.  In large systems it may attempt to make a host system or network resource unavailable to those attempting to reach it. Example: you business network becoming unavailable.

    Ransomware: Ransomware is an advanced type of malware that restricts access to the computer system until the user pays a fee.  Your screen might show a pop up warning that your have been locked out of your computer and  that you can access only after paying the cyber criminal. The cyber criminal demands a ransom to be paid in order for the restriction to be removed. The infamous Cryptolocker is one type of ransomware.

It is very difficult to live without computers or mobile devices and we have come to depend on them for many activities – communication, online purchases and payments, etc.., In order to protect our devices and data against the different types of malware mentioned above, an effective anti-malware solution is required.

Πως να προστατευτείτε από απάτες "ψαρέματος" (phishing) με απλές μεθόδους

Είναι πλέον δύσκολο να μην αντιλαμβανόμαστε την αυξανόμενη συχνότητα των επιθέσεων phishing μέσω ηλεκτρονικών μηνυμάτων. Μέσα σ' αυτή τη χρονιά, οι συχνότερες επιθέσεις έγιναν σε χρήστες Google Cloud Docs. Τα λογισμικά καταπολέμησης κακόβουλων επιθέσεων γίνονται ολοένα και πιο 'εξυπνα' ή καλύτερα πιο αποτελεσματικά έτσι οι προσπάθειες καταδολίευσης και απάτης επικεντρώνονται πλέον από τους hackers στην 'ολίσθηση' στο λάθος των χρηστών.

Ακόμη και να νομίζετε ότι δεν σας αφορά αυτό το άρθρο, αξίζει να το διαβάσετε. Μπορεί να μη πληρώνετε μέσω διαδικτύου, μπορεί να 'νομίζετε' ότι δεν έχετε ευαίσθητες πληροφορίες στην 'διαδικτυακή σας παρουσία'. Όμως ΕΧΕΤΕ. Από τη στιγμή που χρησιμοποιείτε το διαδίκτυο ΕΙΣΤΕ ΕΥΑΛΩΤΟΙ!

Τι είναι το phishing;

Οι επιθέσεις phishing όπως αντιλαμβάνεται κανείς, είναι προσεγγίσεις που μοιάζουν νάναι νόμιμες και λογικές, προερχόμενες από ηλεκτρονικά μηνύματα ή/και (σε συνδυασμό) με ιστοσελίδες με πρωταρχικό στόχο την ανάκτηση πρόσβασης στο ηλεκτρονικό ταχυδρομείο του χρήστη ή έμμεσα/αμεσα στους τραπεζιτικούς λογαριασμούς του. Είναι με πανουργία και αποτελεσματικότητα προετοιμασμένες επειδή φαίνεται να προέρχονται από οργανισμούς ή εταιρείες με τις οποίες συνεργάζεστε. Σας οδηγούν σε σελίδες πανομοιότυπες με αυτές που έχετε εμπιστευτικά δεδομένα. Πέφτει στην παγίδα ο χρήστης και βάζει τους κωδικούς του νομιζόμενος ότι εισέρχεται είτε στην ασφαλή πύλη του ηλεκτρονικού ταχυδρομείου του ή στη σελίδα της τράπεζας του που του ζητά να επαναβεβαιώσει τους κωδικούς του. Ο σκοπός του ψαρέματος είναι πάντα ο ίδιος, να αποκτήσει πρόσβαση σε ευαίσθητες περιοχές του χρήστη. Οι hackers τότε αντιγράφουν τον τρόπο γραφής του χρήστη, τιμολόγια που συνήθως πληρώνει και κλέβει την (ηλεκτρονική) ταυτότητα του.

Απλοί τρόποι να μην είστε το επόμενο θύμα phishing

Πάντα να σκέφτεστε διπλά πριν κάνετε κλικ σε σύνδεσμο (link) που σας δίνεται είτε μέσω ηλεκτρονικού ταχυδρομείου (email), SMS, messenger κλπ. Αναρωτηθείτε αν ο αποστολέας θα σας έστελνε μήνυμα τέτοιου περιεχομένου. Θα σας ζητούσε κάτι τέτοιο; Για παράδειγμα οι τράπεζες συνεχώς σας θυμίζουν ότι δεν σας ζητούν τους κωδικούς σας είτε από ηλεκτρ. μήνυμα ή άλλη ιστοσελίδα. Αποφεύγετε επίσης να κάνετε κλικ σε συνδέσμους τύπου shortURLs (π.χ https://goo.gl/Z6gYE5, http://alturl.com/i3tew αυτά είναι ασφαλή), δεν ξέρετε που σας οδηγούν. Με τον ίδιο τρόπο να αποφεύγετε να στέλνετε μηνύματα με τέτοιους συνδέσμους. Δεν είναι παράνομο ή κακό αλλά όταν οι παραλήπτες σας γνωρίζουν ότι δεν χρησιμοποιείτε τέτοιους συνδέσμους, ΔΕΝ θα ανοίξουν ένα τέτοιο σύνδεσμο αν φανεί ότι αποστέλνεται απο σας.

Συνδέσμοι, URLs, Domains

Επίσης οι σύνδεσμοι δεν σημαίνει ότι σας οδηγούν σ' αυτό που φαίνεται στο κείμενο. Π.χ www.bankofcyprus.com ενώ νομίζετε ότι σας οδηγεί στην Τράπεζα Κύπρου, σας παίρνει στην Google! Κοιτάζετε το σύνδεσμο που γράφει στην κάτω μεριά του προγράμματος email που χρησιμοποιείτε (status bar). Εκεί φαίνεται πραγματικά η ιστοσελίδα που θα ανοίξετε. Οι hackers φυσικά δεν θα σας στείλουν σε 'αθώες' σελίδες όπως η Google Search Engine.
Κοιτάζετε πάντα στο address bar του browser σας και βεβαιώνετε ότι είστε στη σελίδα που θέλετε να είστε. Απομνημονεύετε τους σημαντικούς διαδικτυακούς χώρους ενθυμούμενοι το domain τους. Για παράδειγμα, η www.hellenic-bank.com ΔΕΝ ΕΙΝΑΙ η Ελληνική τράπεζα (Κύπρου) της οποίας η σελίδα φυσικά είναι www.hellenicbank.com (χωρίς την '-').
Προσοχή στην λεπτομέρεια!
 Οι phishers είναι έξυπνοι, ρισκάρουν, είναι θρασείς. Βελτιώνουν τις τεχνικές τους και σκαρφίζονται καινούργιες μεθόδους προσέγγισης του θύματος. Παίζουν ιδιαίτερα με αναγραμματισμούς των ονομάτων. Οι ιστοσελίδες http://helenicbank.com/ ή  http://hellenikbank.com/ φυσικά ΔΕΝ σας οδηγούν στην Ελληνική τράπεζα. Ο ένας συνδεσμος είναι με ένα 'l' αντί με δύο ενώ ο άλλος είναι γραμμένος με 'k' αντί με 'c'.

Ηλεκτρονικά μηνύματα, Emails

Προσέχετε τα ηλεκτρονικά μηνύματα από που προέρχονται. ΜΗΝ βλεπετε ΜΟΝΟ το όνομα. Για παράδειγμα ένα μήνυμα από τον "Christos Andreades <234ss44ff gmail.com="">" είναι προφανές ότι δεν είναι από τον Χρίστο τον οποίο ίσως ξέρετε!
Με τον ίδιο τρόπο μπορεί να γνωρίζετε κάποιο Χρίστο με email christos@mydomain.com αλλά λαμβάνετε μήνυμα από το email christos@my-domain.com. Υπάρχουν πολλαπλά τέτοια κρούσματα.

Πολλοί χρήστες του διαδικτύου χρησιμοποιούν δωρεάν υπηρεσίες email όπως της Google (gmail), Microsoft (outlook.com, hotmail.com), Yahoo (yahoo.com) κλπ. Πολλοί επίσης τα χρησιμοποιούν και για επαγγελματική χρήση (κακώς!)
Εδώ οι hackers πάλι αναγραμματίζουν το username. Γνωρίζετε πχ κάποιον με email nikoshalikakakis@gmail.com. Σας στέλνουν email με αποστολέα nikoshallikakakis@gmail.com. Ένα 'l' περισσότερο! όμως ΔΕΝ είναι από τον γνωστό/συνεργάτη/πελάτη σας!

Ένα τελευταίο στα email που πρέπει να προσέχετε είναι ποιος είναι ο αποστολέας και ποιο email είναι δηλωμένο για 'reply to'. Είναι μια από τις ιδιότητες των email. Μπορώ για παράδειγμα να στέλνω email με το όνομα μου και το email μου αλλά θέλω οι απαντήσεις (replies) να πηγαίνουν στο 'κεντρικό' email της εταιρείας μου:
Christos Doe
reply to: MyCompany
Αυτή την ιδιότητα κάνουν πολλοί hackers χρήση γιατί υπάρχει (εύκολα) η δυνατότητα να στείλουν email κάνοντας χρήση ένα πραγματικό email που γνωρίζετε αλλά για σκοπούς επικοινωνίας μαζί του και όχι με τον γνωστό σας, βάζουν στο reply to το email του hacker!

Εταιρειες με καλή δομή στις email πλατφορμες τους κάνουν χρήση του λεγόμενου SPF Record το οποίο μπορεί να απαγορεύει στους διάφορους mailservers να αποδέχονται email των εταιρειών αυτών αν δεν προέρχονται από τους δικούς τους mailservers.

Λογισμικά προστασίας

Η χρήση λογισμικών προστασίας (antivirus, antimalware, firewalls κλπ) ΔΕΝ ΕΙΝΑΙ παντα αρκετή! Πρέπει να προσέχετε διπλά, σαν να μην έχετε προστασία! Οι επιθέσεις απάτης μπορούν να έρθουν είτε από email, instant messaging (messenger, whatsup etc) ακόμη και από SMS! Σκεφτείτε διπλά πριν δώσετε ευαίσθητα στοιχεία σας μέσω κάποιου μέσου που αναφέρουμε ποιο πάνω.

Τιμολόγια, πληρωμές

Ελέγχετε όταν κάνετε πληρωμές τιμολογίων. Τα τιμολόγια πολλές φορές αναγράφουν αριθμούς λογαριασμών τραπεζών που πρέπει να γίνει η πληρωμή. Συγκρίνετε τους αριθμούς αυτούς με τους αριθμούς που έχετε κάνει χρήση σε προηγούμενη πληρωμή. Αν ακόμη συναλλάσεστε συχνά με αυτή την εταιρεία και κάνετε πληρωμές μέσω online banking, φυλάξετε τις εταιρείες αυτές στους beneficiaries που σας δίνει δυνατότητα (συνήθως) η τράπεζα σας να φυλάξετε.
Αν παίρνετε εντολές πελατών σας για πληρωμές, επιβεβαιώνετε μαζί τους με δεύτερο τρόπο (πχ SMS verification) ότι σας έστειλε να κάνετε αυτή την πληρωμή.

Επιπλέον προστασία

Τέλως ακόμη μια καλή μέθοδος προστασίας είναι και το multi-factor ή two-step authentication. Πολλοί από σας που κάνετε διαδικτυακές πληρωμές, ήδη το χρησιμοποιήτε με το λεγόμενο 'dongle' που σας υποχρεώνει η τράπεζα να έχετε για τις πληρωμές σας. Πολλές υπηρεσίες Cloud όπως η Google, Microsoft κλπ το παρέχουν και το συστήνουν.

Τελειώνοντας...

Προσέχετε στο διαδίκτυο, έχει καταντήσει να είναι πιο επικίνδυνο από το να περπατάς στο δρόμο....

Μπορείτε να επικοινωνήσετε μαζί μας για περισσότερες πληροφορίες και συμβουλές στο email μας, info(at)scicane.com

Το παρόν άρθρο όπως και τα υπόλοιπα στην ιστοσελίδα αυτή αποτελούν πνευματική ιδιοκτησία της SCICANE LTD και απαγορεύεται η χρήση/αντιγραφή/επαναδημοσίευση μέρους ή όλου του άρθρου χωρίς την έγγραφή αποδοχή της εταιρείας

Περισσότερες πληροφορίες για μας στο About Us

TESTING SMTP AUTH USING TELNET

Test if SMTP authentication is working.

Sometimes you need to test SMTP Authentication is working on your server, and you may not have Outlook or another email client handy to test the connection.

You can verify SMTP authentication is working by using telnet and accessing the SMTP server directly. Below is a quick tutorial on how to test your server with Atmail for SMTP authentication details.

RESOLUTION

1. First, make sure SMTP authentication is enabled via the Atmail Webadmin > Services > SMTP Settings > SMTP Authentication = On
2. Next, create or verify an existing username and password on the system
3. Build the Base64 username/password
   SMTP AUTH LOGIN will encapsulate the username and password as a Base64 string. This is used to prevent sending the username/password plaintext via the network connection. Using Perl, you can issue the following command to encode the username and password as a base64 string, which can be sent to the SMTP server. Note the @ symbol is escaped to pass the string via Perl.
   

   # perl -MMIME::Base64 -e 'print encode_base64("myusername\@domain.com")'
   bXl1c2VybmFtZUBkb21haW4uY29t
   # perl -MMIME::Base64 -e 'print encode_base64("weakpass")'
   d2Vha3Bhc3M=

4. Access the local system. Commands we issue are highlighted in bold.
   

   # telnet localhost 25
   Trying 127.0.0.1...
   Connected to localhost.localdomain (127.0.0.1).
   Escape character is '^]'.
   220 mydomain.com Welcome to the @Mail SMTP Server ( Exim )
   ehlo test.com
   250-mydomain.com localhost [127.0.0.1]
   250-SIZE 52428800
   250-PIPELINING
   250-AUTH LOGIN
   250-STARTTLS
   250 HELP>

   The above command will verfiy AUTH LOGIN is enabled on the server. Next, send the following command to start the SMTP Authentication process.
   

   AUTH LOGIN
   334 VXNlcm5hbWU6 ( Server returns username as a base64 string )
   bXl1c2VybmFtZUBkb21haW4uY29t
   334 UGFzc3dvcmQ6 ( Server returns password as a base64 string )
   d2Vha3Bhc3M=
   235 Authentication succeeded

5. Congratulations, SMTP authentication is now enabled and confirmed working on your server. Note you must send the Base64 string of the username and password as two commands.

“WannaCry” Ransomware

a ransomware attack has emerged that is worthy of tears. WannaCry ransomware has hit the scene, spreading like wildfire across 150 countries and infecting more than 250,000 machines, which includes a massive takedown of 16 UK NHS medical centers in just one day. Other major countries impacted include Spain, Russia, Ukraine, India, China, Italy, and Egypt.

Now, how is this massive attack possible? The ransomware attack exploits the Server Message Block (SMB) critical vulnerability–also known as the Equation Group’s ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers a couple of weeks ago. Basically, the attacker can use just one exploit to gain remote access into a system. Once access is gained, the cybercriminal then encrypts data with a file extension “.WCRY.” Not to mention, the decypter tool used can hit users in multiple countries at once, and translate its ransom note to the appropriate language for that country. The ransom is said to demand $300 to decrypt the files.

The good news is, consumers don’t have to worry about this attack affecting their personal data, as it leverages a flaw within the way organizations’ networks allow devices to talk to each other.

However, this attack does act as a reminder for consumers to prepare for personal ransomware attacks. In order to stay prepared and keep your personal data secure, follow these tips:

-Be careful what you click on. This malware was distributed by phishing emails. You should only click on emails that you are sure came from a trusted source. Click here to learn more about phishing emails. 

-Back up your files. Always make sure your files are backed up. That way, if they become compromised in a ransomware attack, you can wipe your disk drive clean and restore the data from the backup.

-Update your devices. There are a few lessons to take away from WannaCry, but making sure your operating system is up-to-date needs to be near the top of the list. The reason is simple: nearly every software update contains security improvements that help secure your computer and removes the means for ransomware variants to infect a device.

–Schedule automatic updates. It’s always a good practice to set your home systems to apply critical Windows Security Updates automatically. That way, whenever there is a vulnerability, you receive the patch immediately.

–Apply any Windows security patches that Microsoft has sent you. If you are using an older version of Microsoft’s operating systems, such as Windows XP or Windows 8, click here to download emergency security patches from Microsoft. 

–Keep security solutions up-to-date. 

source: McAfee

Barracuda's blacklist - keep out

Barracuda Spam Firewall is a popular spam filtering software. One of the ways it figures out whether an email is Spam or not is through the use of its "Intent Engine". The "Intent Engine" is a human run and maintained blacklist which is turned "On" by default with each new Barracuda installation.
To get blacklisted inside the "Intent Engine" you must first have had a complaint submitted to Barracuda by one of its customers. By default Barracuda assumes all mail is good mail, until that initial complaint is filed. Once a complaint is filed, a person will look at your email for three attributes to determine if it belongs on the blacklist.

1. "To:" line cannot be obfuscated. Anyone who uses blind carbon copy line (BCC line) to load up a list of recipients would fail this test.
2. The email must let the recipient know how they got on the email list inside the body of the message.
3. There must be a one-click unsubscribe link.

If the email fails in any of these areas, then the person analyzing the email will add URLs that are linked to in the email to the blacklist which means that future emails sent by that sender could be blocked. Once your URL gets on the blacklist, any Barracuda customer who has the "Intent Engine" turned on will likely not receive your messages.

We encourage our customers to add a quick one-line explanation to the body of their messages that explain how and where permission was gained from the customer to be on your list. This line can be in the header or the footer of the message. Not only would this help with deliverability, but it would also help make transparent your relationship with the end recipient which is always a good thing.

source: Campaigner
read more: Barracuda Lookup

Barracuda's blacklist - keep out

Barracuda Spam Firewall is a popular spam filtering software. One of the ways it figures out whether an email is Spam or not is through the use of its "Intent Engine". The "Intent Engine" is a human run and maintained blacklist which is turned "On" by default with each new Barracuda installation.
To get blacklisted inside the "Intent Engine" you must first have had a complaint submitted to Barracuda by one of its customers. By default Barracuda assumes all mail is good mail, until that initial complaint is filed. Once a complaint is filed, a person will look at your email for three attributes to determine if it belongs on the blacklist.

1. "To:" line cannot be obfuscated. Anyone who uses blind carbon copy line (BCC line) to load up a list of recipients would fail this test.
2. The email must let the recipient know how they got on the email list inside the body of the message.
3. There must be a one-click unsubscribe link.

If the email fails in any of these areas, then the person analyzing the email will add URLs that are linked to in the email to the blacklist which means that future emails sent by that sender could be blocked. Once your URL gets on the blacklist, any Barracuda customer who has the "Intent Engine" turned on will likely not receive your messages.

We encourage our customers to add a quick one-line explanation to the body of their messages that explain how and where permission was gained from the customer to be on your list. This line can be in the header or the footer of the message. Not only would this help with deliverability, but it would also help make transparent your relationship with the end recipient which is always a good thing.

source: Campaigner
read more: Barracuda Lookup

Barracuda's blacklist - keep out

Barracuda Spam Firewall is a popular spam filtering software. One of the ways it figures out whether an email is Spam or not is through the use of its "Intent Engine". The "Intent Engine" is a human run and maintained blacklist which is turned "On" by default with each new Barracuda installation.
To get blacklisted inside the "Intent Engine" you must first have had a complaint submitted to Barracuda by one of its customers. By default Barracuda assumes all mail is good mail, until that initial complaint is filed. Once a complaint is filed, a person will look at your email for three attributes to determine if it belongs on the blacklist.

1. "To:" line cannot be obfuscated. Anyone who uses blind carbon copy line (BCC line) to load up a list of recipients would fail this test.
2. The email must let the recipient know how they got on the email list inside the body of the message.
3. There must be a one-click unsubscribe link.

If the email fails in any of these areas, then the person analyzing the email will add URLs that are linked to in the email to the blacklist which means that future emails sent by that sender could be blocked. Once your URL gets on the blacklist, any Barracuda customer who has the "Intent Engine" turned on will likely not receive your messages.

We encourage our customers to add a quick one-line explanation to the body of their messages that explain how and where permission was gained from the customer to be on your list. This line can be in the header or the footer of the message. Not only would this help with deliverability, but it would also help make transparent your relationship with the end recipient which is always a good thing.

source: Campaigner
read more: Barracuda Lookup

Business Email Compromise - Protect yourself and your company

Business Email Compromise (BEC) scams, also known as “whaling’ or “CEO fraud”, involve crafted emails sent to recipients by fraudsters pretending to be senior executives. These emails leverage social engineering and urgent requests to get employees to carry out large wire transfers or send over sensitive information such as W2 forms.

BEC is defined as a sophisticated scam targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments. The scam is carried out by compromising legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds.

Most victims report using wire transfers as a common method of transferring funds for business purposes; however, some victims report using checks as a common method of payment. The fraudsters will use the method most commonly associated with their victim’s normal business practices.

BEC emails are typically characterized by:

Impersonation of a high-level executive of your companyEmail domains similar to yours (Typosquatting)Prominent use of freeweb mail service providers (Gmail, Yahoo etc.)Emails that do not contain URLs, phone numbers, or attachments

CHARACTERISTICS OF BEC COMPLAINTS

• Businesses and associated personnel using open source e-mail accounts are predominantly targeted.

• Individuals responsible for handling wire transfers within a specific business are targeted.

• Spoofed e-mails very closely mimic a legitimate e-mail request.

• Hacked e-mails often occur with a personal e-mail account.

• Fraudulent e-mail requests for a wire transfer are well-worded, specific to the business being victimized, and do not raise suspicions to the legitimacy of the request.

• The phrases “code to admin expenses” or “urgent wire transfer” were reported by victims in some of the fraudulent e-mail requests.

• The amount of the fraudulent wire transfer request is business-specific; therefore, dollar amounts requested are similar to normal business transaction amounts so as to not raise doubt.

• Fraudulent e-mails received have coincided with business travel dates for executives whose e-mails were spoofed.

• Victims report that IP addresses frequently trace back to free domain registrars.

self protection strategies 

• Avoid free web-based e-mail accounts: Establish a company domain name and use it to establish company e-mail accounts in lieu of free, web-based accounts.

• Be careful what is posted to social media and company websites, especially job duties/descriptions, hierarchal information, and out of office details.

• Be suspicious of requests for secrecy or pressure to take action quickly.

• Consider additional IT and financial security procedures, including the implementation of a 2-step verification process.

• Establish other communication channels, such as telephone calls, to verify significant transactions. Arrange this second-factor authentication early in the relationship and outside the e-mail environment to avoid interception by a hacker.

• Digital Signatures: Both entities on each side of a transaction should utilize digital signatures. This will not work with web-based e-mail accounts. Additionally, some countries ban or limit the use of encryption.

• Delete Spam: Immediately report and delete unsolicited e-mail (spam) from unknown parties. DO NOT open spam e-mail, click on links in the e-mail, or open attachments. These often contain malware that will give subjects access to your computer system.

• Forward vs. Reply: Do not use the “Reply” option to respond to any business e-mails. Instead, use the “Forward” option and either type in the correct e-mail address or select it from the e-mail address book to ensure the intended recipient’s correct e-mail address is used.

• Consider implementing Two Factor Authentication (TFA) for corporate e-mail accounts. TFA mitigates the threat of a subject gaining access to an employee’s e-mail account through a compromised password by requiring two pieces of information to login: something you know (a password) and something you have (such as a dynamic PIN or code).

The victims of the BEC scam range from small businesses to large corporations. The victims continue to deal in a wide variety of goods and services, indicating a specific sector does not seem to be targeted.

It is largely unknown how victims are selected; however, the subjects monitor and study their selected victims using social engineering techniques prior to initiating the BEC scam. The subjects are able to accurately identify the individuals and protocols necessary to perform wire transfers within a specific business environment. Victims may also first receive “phishing” e-mails requesting additional details regarding the business or individual being targeted (name, travel dates, etc.).

source and further information: Internet Crime and Compliance Center (IC3)