You get an email from an employee. Not super concerning. They’re letting you know that they changed banks and they need to update their payroll info to a new account. Do you do it?
What if it’s a partner agency sending you an invoice for an overdue payment? If you don’t act fast they’ll cut off services. Should you pay it?
All of our initial responses probably fall somewhere between, “Yes” and “Of course!” This is exactly where cyber criminals want you to land. By abusing your trust and your sense of urgency, they can squeeze one or more payments out of you. By the time you catch on, that money is gone–laundered, converted to crypto, or spent.
To combat this, we need to use one of my dad’s cliche sayings: “Trust but verify.” First things first, invoice and payroll scams are on the rise. They are powered by a continued reliance on digital payments and easy access to AI that can tailor an email in seconds. By going on LinkedIn or your company website, an attacker can quickly find a target. A ChatGPT prompt later, and BOOM! Scam email sent. It’s quick enough to repeat hundreds of times a day.
These attacks are a specific classification of phishing email. Most of us are well aware of the tell tale signs of a phishing email. But what about when you’re sleepy, stressed, busy, or a baby is crying or a dog is barking? Say it with me, “Trust but verify.”
Do not use email to verify. Assume the sender’s account is compromised. Call the individual with a number you have on file and NOT the one listed in their signature block. If the bad guys are smart enough to impersonate your employee, they are smart enough to change the signature block to contain their number. Between AI voice cloning or even general luck, attackers can easily convince you over the phone that a payment is legitimate. If it’s a vendor being impersonated, you might not even know what the person on the other end is supposed to sound like. Bypass the trap entirely by using an independently verified phone number.
So what are we going to do to combat invoice and payroll fraud? Say it with me.
TRUST BUT VERIFY.
If you are looking to learn more about Invoice Fraud or other cybersecurity concerns, book a consultation with me here.