Tag: business email compromise

  • Email scams have grown more sophisticated and realistic, here are 5 ways you can still tell

    Email scams have grown more sophisticated and realistic, here are 5 ways you can still tell

    Spotting an email scam used to come with familiar advice: look for spelling mistakes, awkward sentences, and messages that sound a little off. Those clues can still help, but they are no longer enough. Criminals can use artificial intelligence to write convincing messages and correct the language errors that might otherwise give them away. The FBI has warned that these tools are making fraudulent messages more believable and easier to produce.

    For businesses, the danger often arrives looking like an ordinary part of the workday. A vendor sends an invoice, a manager requests a purchase, or an account notification asks you to confirm some information. Scammers imitate these routine interactions because the requests can seem reasonable at first glance.

    You cannot prove that every email is safe just by looking at it. However, these five warning signs can help you recognize when to stop and verify before taking action.

    1. The sender’s details do not match who they claim to be.

    A familiar display name does not establish who actually sent an email. Expand the sender’s information and examine the full email address, especially the domain after the @ symbol. Watch for substituted letters, extra characters, or an unfamiliar domain attached to the name of a company you recognize. Criminals use these small differences to make impersonation attempts look legitimate.

    Compare the address with contact information you already trust rather than relying on the signature in the message. However, even a correct address is not a guarantee of safety. Criminals can compromise genuine business email accounts and use existing conversations to make fraudulent requests seem credible. Treat the sender check as one precaution, not permission to stop checking.

    1. The message pressures you to act before you can think.

    An email threatening immediate account suspension or demanding an urgent payment deserves extra scrutiny. Scammers use urgency, fear, and intimidation to push people into acting before they investigate. The message may sound authoritative and professional while still trying to rush you into a bad decision.

    Be particularly cautious when the sender discourages you from checking with anyone else. In one impersonation scheme documented by the FBI, fraudulent invoices instructed recipients to request payment instructions by email rather than telephone, helping the scammers avoid independent verification. A request that makes it harder to confirm the facts should give you a reason to pause.

    1. The email sends you somewhere unexpected through a link, attachment, or QR code.

    A document-sharing notification or account alert may lead to a fake sign-in page rather than the service it claims to represent. Criminals can copy the appearance of legitimate websites to collect the passwords or financial information people enter. An unexpected attachment also deserves scrutiny, even when it is presented as an invoice or another routine business document.

    QR codes deserve the same caution as clickable links. The FTC warns that scammers include them in emails and text messages to direct people to fraudulent sites. For an unexpected account notice, open the service through a trusted bookmark or its official app instead of following the message’s instructions. Confirm an unexpected document with the sender through a separate, trusted contact method before opening it.

    1. The sender wants your password, sign-in code, or sensitive business information.

    A message claiming to come from technical support may sound helpful while asking you to hand over account access. Requests to reply with your password should be treated as a serious warning. Employees should not send passwords or sensitive information by email simply because a message appears to come from a manager or another trusted person.

    Be just as protective of one-time sign-in codes. Scammers may claim they need a code to investigate suspicious activity or fix an account problem, when their actual goal is to access the account themselves. Do not send someone a code used to authorize your login. Contact your IT provider or the relevant organization through an established channel to verify the request.

    1. The request changes a normal business process, especially where money is involved.

    An email does not need a malicious link or attachment to cause damage. A convincing request to send a legitimate payment to a different account can be enough. Be cautious when a vendor suddenly changes banking details, a manager requests an unusual purchase, or someone asks you to bypass the usual payment approval process. These are situations associated with business email compromise scams.

    Verify changes to payment instructions by calling a number already in your records, not a new number supplied in the email. Keep any required second approval in place, even when the request appears to come from someone senior. An existing email conversation should not replace independent confirmation when the destination of your money changes. We also have this free resource with five more items to look out for when it comes to phishing scams:

    Recognizing suspicious emails should be a shared business practice, not a test employees are expected to pass without support. Give your team a clear process for checking unusual requests and reporting concerns. Regular training and an incident response plan help turn that expectation into something people can actually follow.

    At Valley Techlogic, we help businesses strengthen their defenses with email and phishing protection, employee security awareness training, simulated phishing exercises, endpoint protection, and ongoing security monitoring. These services combine technical safeguards with practical preparation for the people using your systems every day.

    Your employees should not have to make every security decision alone. Reach out to us today to discuss your current protections and how we can help your business reduce its exposure to phishing and other online scams.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • Are you keeping track of breaches that are happening with your vendors? What small businesses can learn from the Klue/Salesforce breach

    Are you keeping track of breaches that are happening with your vendors? What small businesses can learn from the Klue/Salesforce breach

    When most small businesses think about cybersecurity, they think about their own systems first. Are our computers protected? Are our passwords strong? Is our email secure? Do we have backups?

    Those are all important questions. But there is another question that deserves just as much attention: Are the vendors we rely on putting our business data at risk?

    The recent Klue/Salesforce breach is a good reminder that small businesses do not operate in a vacuum. Even if your own network is locked down, your data may still live in someone else’s system. It may be stored in your CRM, marketing platform, accounting software, ticketing system, quoting tool, password manager, payroll provider, or any number of cloud applications connected to each other behind the scenes.

    In this case, public reporting indicates that attackers abused access tied to Klue, a competitive intelligence platform, to reach data connected through Salesforce environments. The important lesson is not just “Salesforce” or “Klue.” The bigger lesson is that connected vendor platforms can become pathways into sensitive business data.

    For small businesses, that matters a lot.

    You may not have a full-time security team watching every vendor announcement. You may not have a compliance department tracking every software integration. But you probably do have customer information, employee information, invoices, quotes, sales notes, passwords, emails, support tickets, or financial records spread across multiple vendors.

    That means vendor breach monitoring needs to be part of your normal security routine. A vendor breach does not have to involve your internal server, your firewall, or your employee laptops to affect you.

    If a third-party platform you use is compromised, attackers may be able to access customer records, support cases, contact lists, documents, billing details, or internal notes. Even when passwords are not exposed, stolen business data can still be used for phishing, impersonation, fraud, social engineering, or targeted scams.

    This is especially dangerous because vendor-related phishing can look very believable. If an attacker knows who your customers are, what services they use, who manages their account, or what projects are active, they can write emails that sound legitimate.

    For a small business, the damage can be immediate. Customers lose trust. Staff waste time investigating. Leadership has to figure out whether notifications are required. And if nobody was watching for the breach in the first place, the business may learn about it too late.

    Three steps small businesses can take to monitor vendor breaches

    1. Keep a simple vendor and data inventory

    You cannot monitor vendor risk if you do not know which vendors have access to your data.

    Start with a simple spreadsheet or shared document. It does not need to be complicated. List every cloud service your business uses, what kind of data it stores, who owns the relationship internally, whether it connects to other systems, and how critical it is to your operations.

    At minimum, track:

    • Vendor name
    • Type of data stored
    • Admin owner
    • Login method
    • Connected integrations
    • Business impact if breached

    Pay special attention to tools connected to email, CRM, file storage, accounting, remote access, security, payroll, and customer support. These systems tend to hold valuable data or provide access to other platforms.

    The goal is simple: if a breach happens, you should be able to quickly answer, “Do we use this vendor, what data is there, and what should we check first?”

    1. Subscribe to vendor security notices and monitor trusted sources

    Many small businesses only hear about vendor breaches from social media, a random news article, or a customer asking whether they are affected. That is not good enough. For your most important vendors, subscribe to their security advisories, status pages, email alerts, and trust center updates. If they offer a security notification list, use it. If they have a status page, bookmark it. If your vendor has an admin portal with security notices, make sure someone checks it.

    You should also monitor reliable cybersecurity news sources and breach notification feeds for vendors you depend on. This does not mean doom-scrolling every day. It means assigning someone to keep a light but consistent eye on the tools that matter most to the business.

    For managed IT clients, this is also an area where your IT provider can help. Vendor breach monitoring should not be treated as an occasional panic response. It should be part of normal operational security.

    1. Have a vendor breach response checklist before something happens

    When a vendor breach hits the news, the worst time to build your response process is after the fact. Small businesses should have a short checklist ready. When a vendor announces a breach, your team should know how to assess whether you are affected and what actions to take.

    A practical checklist should include:

    • Confirm whether your business uses the vendor or affected integration
    • Review what data the vendor stores or can access
    • Check vendor advisories for affected dates, systems, and data types
    • Revoke or rotate API keys, OAuth tokens, passwords, and connected app permissions where appropriate
    • Review admin accounts and recent login activity
    • Look for suspicious email, CRM, file, or support activity
    • Warn staff about phishing attempts tied to the incident
    • Determine whether customers, employees, insurers, legal counsel, or regulators need to be notified
    • Document what was reviewed and what actions were taken

    We have a simple template for this you can grab below that also covers breaches within your business:

    This does not need to be a 40-page incident response plan. It just needs to be clear enough that your team can act quickly and calmly. The big takeaway is that security does not stop at your own front door.

    Modern businesses are built on connected cloud platforms. That brings huge benefits, but it also creates shared risk. A vendor integration, API token, or connected app can become a weak link, even when your own systems are not directly compromised. Small businesses should not respond by abandoning cloud tools, that’s not realistic. The better response is to know which vendors matter, track where your data lives, monitor for breach notices, and have a plan for what to do when something goes wrong. You do not need enterprise-level complexity to do this well. You need consistency, ownership, and a clear process.

    Vendor breaches are no longer rare edge cases. They are part of doing business in a cloud-connected world. The businesses that handle them best are not the ones that never use vendors. They are the ones that know their vendors, monitor their risk, and respond quickly when the situation calls for it. At Valley Techlogic, we act as a vendor liaison for clients and can help you monitor and respond to breaches even if they’re not happening to your organization directly. Learn more today through a consultation.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic

  • AI is making fraud easier and more lucrative, with AI enabled phishing emails seeing 25% higher open rates than human crafted variations

    AI is making fraud easier and more lucrative, with AI enabled phishing emails seeing 25% higher open rates than human crafted variations

    Artificial intelligence has changed the economics of fraud. Scammers no longer need to be skilled writers, native speakers, designers, or even patient researchers to create believable attacks. With AI tools, they can generate polished emails, mimic trusted business language, personalize messages using public information, and test different versions of a scam at scale. We are even seeing instances where scam calls are being placed using AI voice modifications are tricking users into believing the call is regional (often with a spoofed number to really send it home). In a nutshell, scams are getting much more sophisticated and AI is helping bad actors achieve more, faster.

    That matters because phishing and vishing (a portmanteau of “voice” and “phishing”) has always relied on one core weakness: trust. When an email looks familiar, sounds professional, and appears to come from a person or company you recognize, it becomes much easier to click before thinking or hand over information you would never think to provide otherwise. AI makes that easier for attackers and more dangerous for everyone else.

    A representative from Kaseya recently shared with us that AI enabled phishing emails are seeing 25% higher open rates than human crafted variations. While results can vary by campaign, audience, and security training maturity, the takeaway is clear: AI is making phishing more convincing, more scalable, and more profitable for criminals.

    Traditional phishing emails were often easier to spot. They contained awkward wording, strange formatting, vague requests, or obvious spelling mistakes. AI has removed many of those warning signs.

    Today’s phishing emails may reference your company, your vendors, your industry, recent business activity, or a real person inside your organization. They can be short and casual, formal and executive-sounding, or written in the exact tone of a normal business request.

    Even worse, criminals can now generate hundreds of variations quickly. If one version does not work, they can adjust the subject line, tone, timing, sender name, or call to action until something lands. Here are some common variations of phishing scams we’re now seeing as a technology service provider:

    • The message creates urgency, such as “today only,” “final notice,” “immediate action required,” or “payment must be processed now.”

    • The sender asks you to bypass normal processes, especially for payments, password resets, MFA approvals, bank changes, or file access.

    • The email sounds polished but slightly off, especially if the request does not match the sender’s usual behavior.

    • The message includes a link to a login page, shared document, voicemail, invoice, shipping notice, or payment portal you were not expecting.

    • The sender pressures you not to call, not to verify, or not to involve anyone else.

    • The request involves gift cards, wire transfers, ACH changes, cryptocurrency, payroll updates, or sensitive business data.

    We also want to note,accounts payable teams are especially vulnerable because their work already involves invoices, payment requests, vendor communication, banking details, and deadlines. AI gives scammers better tools to blend into that workflow.

    A fake invoice used to be relatively basic. Now, an attacker can create a professional-looking invoice with realistic branding, matching language, convincing line items, and payment instructions that appear normal at first glance. In more advanced cases, criminals may combine fake invoices with compromised email accounts, vendor impersonation, cloned voices, or deepfake video messages that appear to come from an executive, vendor, or finance leader.

    This is where deepfake invoice fraud becomes especially dangerous. The invoice itself may look real, but the larger scam may include an AI-generated voicemail, a realistic video message, or a spoofed email thread that appears to confirm the payment. The goal is simple: make the request feel legitimate enough that accounts payable processes it before anyone verifies the change.

    Here’s how to avoid falling victim:

    • Verify payment changes through a trusted channel. Do not use the phone number or email address included in the suspicious message. Use a known contact from your records.

    • Require secondary approval for new vendors, bank account changes, large payments, urgent wires, and unusual invoice requests.

    • Slow down when a message creates pressure. Urgency is one of the strongest signs that someone is trying to push you into a mistake.

    • Check sender addresses carefully. Look for lookalike domains, extra letters, changed display names, and replies that come from unexpected addresses.

    • Do not approve MFA prompts you did not initiate. Attackers often combine phishing with login attempts and push notification fatigue.

    • Hover over links before clicking, and avoid logging in through links in unexpected emails. Go directly to the known website instead.

    • Train employees with realistic phishing examples, including AI generated messages that look polished and professional.

    • Use modern email security, MFA, endpoint protection, DNS filtering, and identity monitoring to reduce the chances that one bad click turns into a major incident.

    • Build a culture where employees are praised for verifying suspicious requests. People should never feel embarrassed for slowing down a payment or asking for confirmation.

    The bottom line is that AI does not create entirely new fraud. It makes old fraud faster, cheaper, more convincing, and easier to scale. That is why businesses need to stop treating phishing as a problem that only happens to careless people.

    The strongest protection is a combination of technology, training, and processes. Email filtering helps, MFA helps, endpoint protection helps, but for payment fraud, business email compromise, and fake invoice scams, process matters just as much. A quick phone call directly to a known number for the person/company, a second approval, or a strict vendor change procedure can be the difference between catching a scam and wiring money to a criminal.

    Fraud is getting more convincing. Your defenses need to become more deliberate. At Valley Techlogic we are continuously working on future proofing our customers against scams and intrusions, and all of our plans come with cybersecurity built in. Learn more today with a consultation.

    Looking for more to read?

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic and LinkedIn at https://www.linkedin.com/company/valley-techlogic-inc/.

  • Social engineering scams on Facebook, LinkedIn and Twitter are increasing: what to look out for

    Social engineering scams on Facebook, LinkedIn and Twitter are increasing: what to look out for

    Some fraudsters have abandoned the awkward, obvious emails of the past decade in favor of a new gambit, this one focus on social media. Today, they operate where your business already lives: in your LinkedIn inbox, your Facebook admin panel, and your Twitter DMs. The scams are polished, convincing, and growing fast.

    Social engineering attacks rely on manipulation rather than malware. Instead of breaking through your firewall, criminals exploit the one vulnerability no software patch can fix: human trust. In 2024 and into 2025, that manipulation has migrated aggressively onto social media platforms, targeting professionals, business owners, and marketing teams who use these networks as core business tools.

    Understanding how these scams are constructed is the first line of defense. Here is a closer look at what is circulating on each major platform and what warning signs to watch for.

    LinkedIn: fake job offers and recruiter impersonation

    First, The fake job offer scam.One of the fastest-growing threat vectors on LinkedIn involves fraudulent job opportunities delivered via connection requests and direct messages. Attackers create convincing recruiter profiles, complete with employment histories, endorsements, and professional headshots, before reaching out to targets with lucrative-sounding roles at legitimate companies.

    Once contact is established, the “recruiter” moves the conversation off-platform to WhatsApp or email and eventually asks for sensitive information under the guise of onboarding: copies of identification documents, bank account details for direct deposit setup, or payment for background checks and equipment deposits. In some cases, victims are sent fraudulent checks and asked to forward a portion of the funds before the check bounces.

    Luckily there are a few common red flags you can look for to spot this one, such as:

    • The recruiter’s profile was created recently and has few connections or activity.
    • The job offer arrives unsolicited with an unusually high salary and vague responsibilities.

    Also, a more targeted variant involves attackers creating near-duplicate profiles of a company’s senior executives or trusted colleagues. The impersonator connects with employees and then requests urgent wire transfers, gift card purchases, or credential resets, exploiting the authority of the mimicked identity. Because the message arrives through LinkedIn rather than email, many recipients lower their guard.

    LinkedIn has acknowledged the scale of fake profile activity on its platform and introduced detection tools, but sophisticated actors continue to slip through. Treat any out-of-character financial or credential request from a connection with immediate skepticism, regardless of how authentic the profile appears.

    Facebook: business account threats and fake admin messages

    Businesses running Facebook Pages and advertising accounts have become prime targets for a scam that impersonates Meta support. The attack typically begins with a message, often arriving via Messenger or a business inbox, warning that the page violates community standards and faces imminent suspension. Targets are urged to click a link and “verify” their account to avoid action.

    Those links lead to convincing phishing pages that harvest Facebook credentials, two-factor authentication codes, and in some cases payment information linked to the ad account. Once attackers gain access, they drain advertising budgets, lock out legitimate admins, or sell the established account to other bad actors.

    Common red flags for this one are:

    • Urgent language around page violations sent through Messenger rather than through Meta’s official support system.
    • Links that route to domains that are not facebook.com or meta.com.

    A related tactic involves fraudulent invitations to become a page or group administrator. Business owners receive what appears to be a legitimate Facebook notification asking them to accept an admin role for a page they do not recognize. Accepting grants the attacker reciprocal admin access to the victim’s own pages by exploiting Facebook’s cross-admin trust structure. The scammer can then post spam, remove the original owner, or use the page for further fraud.

    Meta will never request login credentials or payment information through Messenger. Any urgent policy warning that arrives as a direct message, rather than through the official Meta Business Suite notification system, should be treated as fraudulent until verified directly through Meta’s help center.

    Twitter (X): impersonation, verification badge scams, and crypto fraud

    Since the overhaul of the platform’s verification program, bad actors have exploited user confusion around the blue checkmark by sending direct messages claiming the recipient’s account requires action to maintain its verified status or avoid suspension. These messages direct targets to external sites that steal credentials or payment details.

    A parallel scam targets business accounts with messages purporting to be from the platform’s trust and safety team, warning of copyright violations or policy breaches and requesting immediate login through a provided link. The urgency and official-sounding language make these messages disproportionately effective against small business owners managing their own accounts.

    Again, common red flags are:

    • Direct messages claiming to be from platform support, since X does not use DMs for official account actions
    • Requests to “re-verify” through a third-party link rather than within the native app settings

     Also, we want to be clear, do not overlook email: phishing remains the dominant threat and it’s also always constantly evolving.

    While social media scams command growing attention, it would be a significant mistake to treat email phishing as a solved problem. Email-based attacks remain by far the most prevalent form of social engineering, accounting for the majority of successful business data breaches year after year. Modern phishing emails have evolved far beyond the broken-English missives of the early 2000s: today’s attempts accurately mimic bank correspondence, software license renewal notices, internal HR communications, and delivery notifications, often using the target’s actual name, employer, and recent activity pulled from public or previously compromised data.

    Business email compromise, a targeted phishing variant in which attackers impersonate executives or vendors to authorize fraudulent payments, cost U.S. businesses billions of dollars annually. The threat is consistent, scalable, and disproportionately effective against organizations that have not established clear verification procedures for financial requests.

    Staff who know to question a suspicious LinkedIn message may still instinctively trust an email that appears to come from their bank or their own CEO. Awareness training must address both channels with equal rigor.

    A local managed service provider like Valley Techlogic is your first line of defense.

    Recognizing individual scam tactics is valuable, but the threat landscape shifts faster than most business owners can track. A local managed service provider like us brings dedicated security expertise, advanced email filtering and phishing simulation tools, and ongoing employee awareness training that keeps your team current with the latest social engineering techniques crossing every channel, from LinkedIn inboxes to email spoofing campaigns. We can also establish clear internal protocols for verifying unusual requests, configure multi-factor authentication across your accounts, and monitor for credential exposure before attackers can exploit it. Partnering with a trusted local provider means that when the next convincing scam lands in your inbox or your social feed, your business has both the technology and the training to recognize it before it does damage. Learn more today with a consultation.

  • 2.5 Billion Gmail users at risk after database leak exposes pertinent account information

    2.5 Billion Gmail users at risk after database leak exposes pertinent account information

    It was recently revealed that Google’s Salesforce database was breached, exposing data for over 2.5 billion users at the time of reporting.

    Initially it was being reported that the leak would primarily effect only their business users as the data found in Salesforce mostly pertains to those accounts. However that was quickly dispelled as Gmail users reported increased attacks against their accounts, with some users reporting they even received a call from alleged Google employees notifying them of the breach of their account.

    We want to make it clear that no password data was leaked in this data breach (at least at the time of writing) instead the data is being used to increase the effectiveness of phishing attacks leveled at Gmail users. One example of the attacks that are occurring includes users being told to initiate an account reset wherein the bad actor intercepts the password and locks the original user out.

    Another attack being initiated is what Google calls “dangling bucket takeover” where the attacker essentially has access to a link connected to the users Google storage and uses it to hijack their account. Google outlines the four ways you can protect against this kind of attack in the page linked.

    While company based accounts might be the most prime targets – and this goes for phishing in general – that doesn’t mean individual users are safe. Spear phishing, a popular variant of phishing that involves researching and gaining access to user accounts outside of their prime target such as an employees close to the company lead, could be a motivator for the current rise in attacks related to this breach. They would then use those accounts to increase the legitimacy of phishing attempts leveled at the primary target (by sending messages as the compromised user).

    It is paramount in 2025 that users practice good safety hygiene when it comes to their online data, especially in an age where the onslaught of data breach news can feel overwhelming and increase a sense of helplessness. Even though data breaches are not rare, users can still protect themselves in the following ways:

    1. Enable Two-Factor Authentication (2FA)
    • Turn on Google 2-Step Verification.
    • Use an authenticator app (Google Authenticator, Authy, or similar) instead of SMS, since text messages can be intercepted.
    • For even stronger protection, consider a hardware security key (e.g., YubiKey).
    1. Use a Strong, Unique Password
    • Avoid reusing passwords across multiple sites.
    • Use a password manager (Bitwarden, 1Password, LastPass, etc.) to generate and store long, random passwords.
    • Change your password immediately if you suspect any compromise.
    1. Regularly Review Account Activity
    • Check Gmail’s “Last account activity” (bottom right of inbox) for unusual logins.
    • Review the Google Account Security page to see devices that have accessed your account.
    • Remove old or unused devices and apps with account access.
    1. Be Proactive Against Phishing
    • Always verify the sender’s address before clicking links.
    • Hover over links to confirm they point to legitimate Google domains.
    • Turn on Gmail’s Enhanced Safe Browsing in account security settings for extra phishing protection.

    Email remains the number one entry point for cyberattacks, from phishing scams to ransomware. At Valley Techlogic, we take a proactive approach to keeping your inbox safe. Our team helps businesses implement advanced spam filtering, real-time threat detection, and encryption to safeguard sensitive communications.

    Beyond just tools, we provide continuous monitoring, security awareness training, and rapid response in the event of a breach. With Valley Techlogic as your partner, you can rest easy knowing your organization’s most critical communication channel is protected. Learn more today with a consultation.

    Looking for more to read? We suggest these other articles from our site.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic and LinkedIn at https://www.linkedin.com/company/valley-techlogic-inc/.

  • Received a weird text from your boss? You’re not alone, text scams are rising in popularity

    Received a weird text from your boss? You’re not alone, text scams are rising in popularity

    You’re sitting at your desk when you receive a text on your phone, it’s allegedly from the CEO of your company. He may say this is his new number (or his personal number) and he’s reaching out to you by name, adding to the legitimacy of the text. If you respond, he’ll say he’s in an important meeting and he needs you to use your company card to buy gift cards as a gift for the attendants of the meeting.

    If you do so, and he’ll be keeping in constant communication with you in spite of being in an “Important meeting”, he’ll say he doesn’t need the physical cards just the codes which you can find if you scratch off the back. He may thank you for being a team playing after providing the codes or stop responding altogether because unbeknownst to you, the scam has been successfully completed.

    Why gift cards? Gift cards are untraceable and usually not refundable when purchased. The scammer will quickly move the funds off the gift card leaving you with the empty plastic remnants and no recourse. Other variations on this scam may request Cryptocurrency instead (such as a message sent pretending to be one of your friends or a family member) but scammers know this would throw up too many red flags in a workplace setting.

    The request even that unusual, if you’re an executive assistant for instance you probably regularly make purchases at the request of your employer. Scammers may target the whole company if they’re unsure who the influencers to the decision maker are or they may target specific individuals.

    How are they getting the information to make their requests see more legitimate? They find it in the following ways.

    1. Your Company Website: Often times your website will have information about your key players on it, including contact information. While we don’t recommend excluding this information to prevent being a target (as it’s valuable to those you want to legitimately do business with) it’s a good idea to remember that it’s out there when you’re getting strange communications via text or email that may call you out by name.
    2. Social Media: This may be your company social media pages or even your personal accounts. We recommend making your personal accounts private and not oversharing on social media in general.
    3. Search Engines: Nothing beats a good old fashioned Google search, and the information that’s available about you online may shock you. Phone numbers, relatives names, addresses etc. can all be found online. While there’s no real way to prevent this, you can somewhat keep track of what’s been made available by creating Google Alerts for your name, email address, etc.

    While text scams may never rise to the prevalence of BEC (Business Email Compromise) attacks – which are being sent out at the rate of 10 per 1000 inboxes per day – it still showcases the way scammers will strategically target you and your business.

    If you are looking to beef up your cyber security protocols in 2024, including providing your employees training to prevent attacks like this one, Valley Techlogic can help.

    Security training is included as part of your monthly plan with us, as well as 24/7 monitoring, data recovery and remediation, backup solutions and more. Get started with us today.

    Looking for more to read? We suggest these other articles from our site.

    This article was powered by Valley Techlogic, an IT service provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.

  • BEC Scams are becoming increasingly more common, and the payouts more lucrative

    BEC Scams are becoming increasingly more common, and the payouts more lucrative

    BEC or Business Email Compromise is a type of phishing scam where the target of the scam receives an email purporting to be someone they know, like a vendor they work with or a colleague. These scams are so common place that the Federal Bureau of Investigation even has a guide to protecting yourself from them.

    We’ve even written before on how to spot a typical BEC email and a few ways to combat it, but we would like to circle back to this topic now as we creep into what is typically a very busy time for most business owners – the fourth quarter.

    You may or may not be surprised to learn that BEC attacks rose in the fourth quarter last year and we’re not anticipating 2023 to be any different. 2022 even saw a rise in the ever popular “as-a-service” variant of attacks which means would be bad actors could enact their attacks with little actual effort on their part.

    The technical know-how required for these attacks is also low, with some of them being as simple as just a variant on your normal phishing scheme but with the end goal being a direct payout rather than the user’s credentials or private information.

    CISA (Cybersecurity and Infrastructure Security Agency) even reported on Russian state sponsored bad actors specifically targeting defense contractors using Microsoft 365 with their BEC schemes. Imitating Microsoft support is not a new scam, and like always you should be wary about any support person reaching out to you directly asking for your credentials, but the single-minded focus of this particular scam put government agencies like CISA and the FBI on red alert.

    When we say these scams are becoming more lucrative, we definitely mean it, with it being estimated BEC victims lost 2.74 billion dollars in 2022 which was $300 million more than 2021. Like with most cyber attacks we anticipate they’ll continue to rise.

    So how do you protect yourself from a Business Email Compromise scam in 2023?

    1. Don’t overshare online. BEC is a social engineering scam, so the less information that’s readily available about you on the internet the less able a scammer is to pretend to be someone you know.
    2. Forward emails instead of replying to them. As with normal phishing these scams are perpetrated over email. Forwarding emails forces you to type out the email address (thereby guaranteeing it goes to the right person). BEC attacks usually involve spoofing an email address or simply choosing a domain that’s similar to one you may be use to corresponding but having a slight misspelling or rewording.
    3. In the same vein, check the sender’s email address before responding at all. You may be able to simply block the scammer when you discover they’re trying to imitate someone else by verifying the email address is incorrect.
    4. Secure your own domain against domain spoofing. Many times, the attack is coming from “inside the house”. A very common BEC scam involves one of your employees receiving an email that looks like it’s from you or someone high up in your organization, except it’s not. Registering the domains you use for email will help protect against this very common variety of this scam.
    5. Again, in the same vein as our last tip, use a domain that you’ve registered instead of a free email service. It might be tempting to keep using the Gmail address you’ve always used to avoid paying for a domain and email services, but it greatly increases your risk of a BEC attack being successful. Using a free email service allows attackers to create a new email with your name to then tell those you know you just “got a new email”. It would be very difficult to prove this is false without talking to you directly.

    Many of the defense strategies against a BEC attack involve employee training.  Attackers may not target you directly as the business owner when it’s easier to get to you (and your business) through a weaker link – often employees who don’t have the strategies available to avoid these kinds of scams.

    Luckily, Valley Techlogic provides security training as part of our service packages. Below is a list of some of the training topics we cover for our clients:

    Cyber security training is quick and is one of the easiest and most effective ways to have an overall safer environment for your business. Learn more about Cyber Security Training through Valley Techlogic as well as other the other cyber security services we offer today through a quick consultation.

    Looking for more to read? We suggest these other articles from our site.

    This article was powered by Valley Techlogic, an IT service provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.

  • Business Email Compromise (BEC) and Phishing – How Do You Combat It?

    Business Email Compromise (BEC) and Phishing – How Do You Combat It?

    Business email compromise (BEC) and phishing are not new ways to scam, as soon as email rose to popularity as a dominant form of communications scammers saw a lucrative window and took advantage.

    Before we explain how to avoid it we should explain what Business Email Compromise (BEC) is. BEC is when a legitimate business is sent an email that looks like it’s coming from another legitimate business, but it’s not. It’s actually a scammer spoofing that email identity. This is the most popular form of phishing but it’s far from the only version. Scammers can even spoof your own domain, so an email looks like it’s coming from within your own organization.

    How do you combat something so insidious? The top way is training, by training yourself and your employees properly on what to look for then you can avoid these scams which cost people located in the US $57 million last year.

    Here are some of the things we look for when determining is an email is a phishing attempt.

    1. It may contain a generic greeting such as “Hello sir or madam” or “Hi Dear” a company you do business with or a person you know would probably know your name.
    2. The email mentions some kind of fraudulent activity on your account and has a link asking you to confirm your private details to unlock or otherwise reinstate your account. This is a VERY common scam.
    3. The links in the email are NOT from the business the email is purporting to be when you hover over them.
    4. The email may contain spelling errors and sentences that sound strange grammatically.
    5. The logos in the email may be of a poor resolution because these scammers do not have access to the real company assets.
    6. The email is coming from a CEO or President of a large organization and is asking you to wire money in exchange for a lump sum in return later. These emails may not have spelling errors or strange links but ask yourself – would any CEO or President of a large company be asking you to wire them money?

    That last one is key, if all the obvious methods of detection fail you may have to rely on just asking yourself if the request in the email makes sense. If the email looks like it is coming from someone you know personally, reach out to them via phone or in person to ask about it. Most of the time, victims who have had their emails compromised or spoofed have no idea it’s even going on.

    Beyond training on knowing what to look for in a phishing email these are our top 3 things to protect yourself from scams across the board.

    1. Keep the software on your devices completely up to date.
    2. Use Multi-factor or 2 Factor Authentication on your accounts.
    3. Backup your data regularly so on the off chance something happens, you’re covered.

    If you receive an email you suspect is a phishing attempt, the best thing to do is not respond to it and report it. You can report suspected phishing emails to the FTC here.

    For businesses located in the Central Valley, we offer cyber security training as part of our managed service plans (which includes comprehensive training on how to avoid phishing attacks).

    Phishing training available

    Looking for more to read? We suggest these tech articles from the last week.

    This article was powered by Valley TechLogic, an IT provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.

    Looking for IT Services in Fresno, Modesto, Stockton, Ceres, Atwater, Merced, Visalia or Lodi? We cover all these areas and more!