Small businesses face a myriad of risks daily, including evolving cybersecurity threats. As a strategic financial partner of many small and mid-size businesses, my team and I have intimate knowledge and insights of emerging cyber threats.
Businesses need to anticipate threats and stay a step ahead of increasingly sophisticated cyber threats. Many businesses have turned to automation to manage their finances, making financial solutions with built-in fraud protection such as Integrated Payables, Positive Pay and Payee Verification incredibly valuable. While such protective measures are a critical first line of defense against payment fraud, businesses also need to take a proactive approach to protect against cyber risks involving consumer and financial data.
Educating your workers on how social engineering can be used to compromise email accounts and helping them understand how cybercriminals prey on our psychology can help your workers better identify potential threats.
Ways that cybercriminals use psychology
There are four main ways cybercriminals use psychology to persuade and bait you into giving them access to your data.
Urgency and fear
Preying on workers’ fear and urgency is probably one of the most common techniques used by cybercriminals. Cybercriminals create a sense of urgency to pressure people into making a bad decision. Some common examples are:
- Posing as a cybersecurity company.
- Threatening a sudden account closure or asking you to dispute unauthorized purchases.
- Impersonating important HR issues.
- Notices for expiring passwords, late payments, missing funds, etc.
- Authority figures such as the CEO, CFO or IRS demanding immediate cooperation.
Talk with your team members around how money and payment requests are handled at your business and encourage them to verify any requests that seem suspicious and deviate from regular routine. Remind your team members that it is better to verify twice when it comes to handling money movement requests.
Courtesy and kindness
Cybercriminals use our innate sense of compassion and helpful nature to their advantage. For instance:
- Fake charities soliciting money for humanitarian crises.
- Impersonating a colleague or friend who needs help wiring money to them.
- Social Security personnel asking for verification of an SSN because their computer is down.
In any of these instances, call the organization or person involved to make sure their request is legitimate.
Curiosity and excitement
Everyone likes feeling lucky and cybercriminals often use this desire to scam people. These are some common examples:
- Ads for heavily discounted items that cannot be found anywhere else online.
- Winner of prize money or contest that you did not apply for.
- Clickbait video and photo links.
As the saying goes, if it seems too good to be true, it probably is. Be sure to verify the source and contact the organization directly instead of clicking on the link.
Ignorance and trust
This is a broad category and sometimes the “bait” looks harmless, which makes it even more convincing:
- Spear phishing, which means individually targeted scams using data specific to the victim.
- Survey scams where you may be asked to input personal information.
- Social media messaging.
Remind your workers to limit social media use on their work computer and to avoid clicking on links from unknown sources. And even if the source is known, if the request seems out of the ordinary, always contact the people making the request directly instead of just replying to the email.
Follow these best practices to protect your data
Knowing these common examples can save your business from falling victim to ransomware and data breaches. To add an extra layer of defense, use these best practices to protect your data:
- Data collection: Know what type of data you want to collect and how.
- Data storage: Decide where you want to store the data. Be sure to store it on a trusted platform that uses encryption.
- Data sharing: Most systems are cloud based and share data within an ecosystem (e.g., connecting Shopify with Quickbooks). Do not solely rely on systems to protect your data. Instead, know where and who has your data in the event of a data breach. In addition, knowing when and how your business intends to use customer data is important. As a business owner, you need to know the implications of using customer data and their right to privacy.
Understanding these basics will put your business in a better position to prevent a data breach. And talking to your banking partner about how you can manage and protect your data can save your business from reputational damage and financial loss.
Bremer Financial Corporation is a privately held, regional financial services company with $16 billion in assets. Founded in 1943 by Otto Bremer, the company is headquartered in St. Paul, Minnesota, and provides a comprehensive range of banking, mortgage, investment, wealth management, and insurance products and services.