Recognizing email threats and social engineering

In the past few years, the sophistication of tactics used to commit cyber and fraud attacks has significantly evolved. Historically, fraudsters have hacked into email accounts and attempted to guess online banking passwords. Recently, attempts have included actions such as porting victims’ mobile phone numbers to cellular devices the fraudsters control, and gaining entry into computers via remote access scams, which exposes all of a victim’s confidential data, not just banking details. And with the rise of artificial intelligence (AI), attacks are becoming more complex, covert and difficult to detect.

Recognize the types of social engineering email threats:

1. Email phishing: Fraudsters attempt to trick individuals into replying to or clicking a link in an email that may appear to be legitimate. Phishing emails can contain malicious software (malware) or attempts to convince the recipient to divulge sensitive information such as confidential data or account credentials. Spear phishing, a more targeted form of phishing, can use information collected online or via social media to make the email, and request within it, appear more credible.
2. Email spoofing: Fraudsters mimic or spoof an email to convince targets that the email they are receiving is from a known and trusted source. This can be done by modifying the header in a malicious email to pose as a trusted sender—for example, @deancoLLC.com can appear similar to a known vendor @cleancoLLC.com. Similarly, a fraudster can copy a logo from a known company to trick their target into thinking it’s a credible email.
3. Email account compromise: Fraudsters use a victim’s legitimate username and password to gain access to the person’s account to send, receive and view their target’s email. Through an email account compromise, they are looking to capture information such as details on upcoming financial transactions or to manipulate a wire transfer into their accounts.
4. Voice phishing (Vishing): Fraudsters spoof or mask the caller ID to make the call seem as if it is coming from a known or legitimate contact to make it appear authentic. Through Vishing, they will voice phish individuals into providing their personal or financial information.
5. Text phishing (SMiShing): Fraudsters spoof or mask the phone number of the sender to make the message seem as if it is coming from a known or legitimate contact to make it appear authentic. Through SMiShing, they will phish individuals using SMS text messages to trick individuals into clicking on a link or calling the phone number provided, and disclosing personal or financial information.

What you can do

For individuals

Recognize phishing email warning signs, such as poor grammar and spelling, urgent language, hyperlinks or attachments, fake logos, a vague email address and no or vague contact information.

1. Do not assume a request is genuine just because the requester knows information about you or your company.
2. Do not call unknown numbers. Always use the telephone numbers that appear on your statement or on the company’s website.
3. Confirm the identity of the requester via an alternate, verified method, and check the email address: Scammers often use spoofed email addresses to send what seem to be legitimate requests.
4. Be cautious of clicking on any links or attachments sent to you in emails or text messages.
5. Limit the information you post on social media. Every account is a venue for a hacker to gain intelligence on you.
6. Create strong and complex passwords, change them frequently, and never share them. Leverage multi-factor authentication for additional security.
7. Update operating systems and anti-virus software on computers and mobile devices to the latest versions as soon as they become available.
8. Encrypt sensitive information such as account numbers, tax information or other personal information before emailing it.

For businesses

1. Educate your employees about threats in the fraud landscape and how they can mitigate risk. Consider implementing a fraud awareness education program. 
2. Implement a social media policy for employees to ensure critical information about staff with privileged responsibilities and their roles is not available to the public.
3. Employ additional spam reduction solutions or filters, if needed, to help reduce the risk of malicious emails reaching employees’ inboxes.
4. Implement the email authentication protocols Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM) and Domain-Based Message Authentications, Reporting and Conformance (DMARC) to greatly enhance the authenticity of the emails your organization sends and receives.
5. Use a proxy internet filtering service to help block employees from visiting potentially malicious web pages and links found in spam email.

If you believe you have been targeted by a social engineering attack, or your login credentials have been compromised, please contact your J.P. Morgan team immediately.