Social engineering fraud (SEF) is a common form of cyberattack against businesses of all sizes. This is when scammers attempt to steal company information or funds using deceptive tactics. SEF involves psychological manipulation to get people to compromise sensitive data they would normally never disclose to any shady person or group. Some of the many common subversive strategies employed by scammers include email phishing attacks, social media posts, and text or voice messages.

If you or one of your employees unwittingly falls for SEF, it could potentially cost your business a lot of money. You might also lose customer trust if their sensitive data gets compromised in a cyberattack. To protect your reputation, money, and consumer trust, it’s crucial to be proactive. Here are some strategies you can take to protect your business from social fraud.

Use a Global Address List

Often, cybercriminals pose as trusted individuals from within the company. This is especially common with larger businesses because criminals know that staff from different departments are less likely to know each other well. A scammer may call a customer service agent claiming to be a human resources personnel member who needs sensitive information from them.

One way your business can combat this sneaky tactic is by using a company-wide global address list. This is an address book containing all of the phone numbers, addresses, and other contact information for all employees. If one of your workers receives a compromising information request from someone claiming to be another employee, they can quickly check the global address list. When they notice the scammer’s phone number doesn’t match that of the HR member the scammer is claiming to be, they’ll know not to divulge sensitive information.   

Set Up a Workplace Education Program

As the tactics of criminals become more convincing and high-tech, it’s easier than ever for employees to fall victim to their tricks. That’s why it’s wise to set up a workplace education program to teach workers what to look for in phishing emails and other forms of social fraud. You can have someone in-house do the training or hire a third-party professional. If possible, hold these types of education programs at least once per year to help staff members stay up-to-date with the latest cyberattack tactics.

Between official training dates, remind your employees how important it is to scrutinize every email and text message, especially those with links. Rather than clicking on an in-text link that appears to be from a trusted individual, they should always go directly to the source. They can do that by calling the supposed sender to confirm they sent the link before opening it. It’s better to be cautious than it is to be too trusting and fall for a scam.  

Test Your Team’s Readiness Using Attack Simulations

Regularly exposing your team to attack simulations using cutting-edge social fraud techniques can be extremely helpful. Work in tandem with your IT team to send mock vishing or phishing emails to team members. Try to make these as convincing as possible to see how many employees fall for them.

This may seem mean, but it’s one of the ideal ways to identify how well-trained your workers are. If many of them fall for your attack simulations, you’ll know it’s time to ramp up your training efforts. Don’t publicly let the entire company know who did and did not fall for the attack simulations. Instead, approach employees individually and let them know how to spot similar phishing attempts from actual scammers.

Analyze Your Cyber Insurance Policy

Despite your best efforts, you or one of your employees may still fall for a particularly convincing social fraud attack. It’s imperative to make sure your company has a good cyber insurance policy in place to minimize your losses. Look for a policy that covers some or all of the following threats.

• Business email compromise (BEC) and other social engineering attacks
• Corporate identity theft
• Ransomware
• Damaged reputation
• Leadership liability
• Loss of business and other expenses related to cyberattacks

Discuss your company’s unique cyber-related risks with your insurance agent to determine what coverage is appropriate for your needs.

Upgrade Your Tech Protection

To combat social engineering fraud and other cyberattacks, upgrade your data protection apps and services. Simple technology like multifactor authentication (also known as “Two-step Verification”) can help your business screen out bot-distributed scams. This is a type of technology that requires users to use more than one login method to prove they’re who they say they are. Common authentication methods include a PIN, verification code sent to your phone, or facial or fingerprint recognition.

Other good forms of tech protection include behavioral biometrics, next-generation firewalls, endpoint protection platforms, and antivirus software. If employees access sensitive information from home or other computers, require them to log into a virtual private network (VPN) first. This is a network that protects your privacy and data from ill-intended third parties by routing your internet traffic through a remote server.  

Whether your company is large or small, it’s essential to protect its sensitive information from cyberattacks. Such attacks cost American companies a lot of money in losses each year. If you’re wise, you don’t have to become a victim. Use these strategies to protect your workers and business from falling for social fraud.

Published by: Josh Tatunay