Cyber-savvy fraudsters targeted in North Simcoe

Cyber fraudsters are targeted during Cyber Month in October. Oct. 19, 2023.

There's no catch-and-release program once phishing scammers infiltrate a company's email.

During October's Cyber Month, the Canadian Anti-Fraud Centre has partnered with the Southern Georgian Bay Detachment of the Ontario Provincial Police to caution businesses and workers about scams they may encounter.

Spear phishing

Spear phishing fraud is among the most prevalent frauds targeting businesses and organizations. Fraudsters take their time to collect information on their intended targets so they can send convincing emails from a seemingly trusted source.

Fraudsters will infiltrate or spoof a business or individual's email account. They create a rule to send copies of incoming emails to one of their accounts and will comb through the emails to:

• study the sender's use of language.
• look for patterns linked to important contacts, payments, and dates.

Fraudsters launch their attack when the owner of the email account can't be easily contacted by email or by phone.

It may look like a top executive sending an email to their accounts payable department requesting an urgent payment to close a private deal.

If the fraudsters haven't infiltrated the executive's email account, they may set up a domain similar to the company's and use the executive's name on the account. The contact information they need is often found on the company's website or through social media.

• Download the CTV News app to get local alerts on your device 
• Get the latest local updates sent to your email inbox 

Variations of spear phishing attacks include:

• A business receives a duplicate invoice with updated payment details supposedly from an existing supplier or contractor.
• An accountant or financial planner receives a large withdrawal request that looks like it's coming from their client's email.
• Payroll receives an email claiming to be from an employee looking to update their bank account information.
• Members of a church, synagogue, temple, or mosque receive a donation request by email claiming to be from their religious leader.
• An email that seems to come from a trusted source asks you to download an attachment, but the attachment is malware that infiltrates an entire network or infrastructure.
• An email that seems to come from a trusted source asks you to buy gift cards.
• Correspondence or email claiming to be from your landlord asking you to send your rent payment using an alternate payment method or to a different account.

Warning Signs

• Unsolicited emails.
• Direct contact from a senior official you are not normally in contact with.
• Unusual payment request from a senior official.
• Pressure or a sense of urgency to complete transaction.
• Unusual requests that do not follow internal procedures.

How to protect yourself

• Remain current on fraud targeting business and educate all employees.
• Include fraud training as part of new employee onboarding.
• Put in place detailed payment procedures.
• Encourage a verification step for unusual requests.
• Establish fraud-identifying, managing and reporting procedures.
• Avoid opening unsolicited emails or clicking on suspicious links or attachments.
• Take a few seconds to hover over an email address or link and confirm that they are correct.
• Restrict the amount of information shared publicly and show caution with regard to social media.
• Routinely update computer and network software.
• Consider getting your business certified with CyberSecure Canada.
• Learn more tips and tricks for protecting yourself.

Anyone who suspects they have been the victim of cybercrime or fraud should report it to their local police and to the Canadian Anti-Fraud Centre's online reporting system or by phone at 1-888-495-8501.

If not a victim, report it to the CAFC anyway.