You’ve worked hard to establish your company. You spent countless hours vetting business partners and potential employees, you scrimped and saved to get your organization off the ground and you sank your energy into building relationships with your clients.
Finally, all your hard work has paid off and you have a healthy nest egg sitting in your corporate bank account. One night, you check your inbox, nonchalantly clicking through work emails, marketing promotions, and personal correspondence before retiring for the weekend.
You return to work on Monday to realize that your business account is overdrawn. There is nothing left in the account. You got jacked!
Avoiding Catastrophe & Chaos
This is what it’s like to be the victim of corporate account takeover. A cybercriminal gains access to a business’ bank account by stealing an employee’s password and credentials, then wires the funds to an outside account.
Lifting account information is easier than you might think. Typically a black hat hacker will target a high-level employee with a spear phishing email, often spoofed to look like a legitimate message from the IRS or your bank, which alerts the employee that something is vaguely (yet urgently) wrong with their account and requires immediate attention.
The user may, unwittingly, open an attachment containing malware or click a link redirecting them to a fraudulent sign-in page where he or she will imprudently turn over their login credentials. In an instant, your bank account can be cleared out while the hacker walks away with fat pockets.
Thankfully, there are a few cyber security services and techniques built to block corporate account takeover. The first is to develop a general template or incident response plan to go into effect anytime something appears to go wrong with the bank. If you or your employee receives an email alerting them of suspicious account activity, advise them not to click the message. This will avoid a vast majority of account takeover attacks.
Instead, advise the employee to report the message through the proper channels (depending on your business structure) and follow up with the bank through a verified phone number. Remember that if something is amiss in your account, the bank will likely reach out to you immediately, but their emails will not redirect you to a sign-in page since they are acutely aware of phishing scams.
Next, consider working with your IT team to change passwords or disconnect the computers used for internet banking. The goal here is to quarantine the problem before you get robbed.
If you believe incursion has occurred, contact your bank and insurance carrier immediately to assess the damages and recover your money so your business doesn’t face excessive downtime.
Finally, work with a computer forensic team and law enforcement to review the corporate account takeover attack. It may also be helpful to review your cybersecurity holistically to see if the cyber attacker was able to infiltrate your network in another way.
Education Is the Best Defense
While it may be impossible to stymie all instances of hacker intrusion, businesses can greatly reduce the risks to cyber security by educating their employees about proper protocol. Below are a few tips to strengthen your internal security.
Eschew weak passwords for stronger passphrases: Hackers often use automated brute force attacks to guess passwords. Make it a little harder for them.
Update your software regularly: Software developers regularly patch security gaps in their programs with each update. Ignoring prompts from your software and add-ons opens your network up to known vulnerabilities which hackers are more than willing to target.
Avoid shadowing IT: Advise your employees to refrain from using or downloading unapproved sites, services and programs. At best, the program is legitimate but open to disaster since it flies under IT’s radar. At worst, it’s a harmful program stealing your confidential information. If an employee absolutely must use shadow IT, at least require them to disclose it to IT before doing so.
Human error might be the key to the digital incursion, but a robust cyber security policy can work wonders in preventing its worst effects.
Other Articles
