In the United Kingdom and Eire, homebuyers and sellers are being targeted by cybercriminals using a new solicitor email scam. The scam, which involves mimicking a solicitor, is costing victims thousands. There have also been some reported cases of cybercriminals sending solicitors emails claiming to be their clients and requesting changes of bank details. Any pending transfers are then made to the criminals’ accounts.
Since funds for home purchases are transferred to solicitors’ accounts before being passed on to the sellers, if cybercriminals are able to change the bank details for the transfers, the funds for the purchase will be paid directly into their accounts.
While email spoofing is commonplace, this solicitor email scam often involves the hacking of solicitors’ email accounts. Once access has been gained, cybercriminals search for emails sent to and from buyers and sellers of homes to identify potential targets. While the hacking of email accounts is occurring, there have also been instances where emails between buyers, sellers, and their solicitors have been intercepted. When bank details for a transfer are emailed, the hackers change the bank information in the email to their own and then forward the email on.
The solicitor email scam is highly targeted and communications are monitored until the crucial point in the purchasing process when a bank transfer is about to be made. Since the potential rewards are considerable, cybercriminals are willing to put the time and effort into the scam and be patient. Buyers, sellers, and solicitors are well researched and the emails are highly convincing.
Instances of this conveyancing scam have been increasing in recent months and it has now become the most common cybercrime affecting the legal sector. The Law Society, a representative body for solicitors in the UK, has issued a warning about the conveyancing scam due to an increased number of complaints, although it is currently unclear how many fraudulent transfers have been made.
There is of course an easy way for solicitors to prevent such a scam from being successful, and that is to contact the homebuyer or seller before any transfer is made and to verbally confirm the bank details by telephone. Alternatively, policies can be developed requiring bank account information to only be sent via regular mail.
The Solicitors Regulation Authority advises against the use of email for property transactions due to the potential for cybercriminals to intercept and spoof messages. Email may be convenient, but with such large sums being transferred it pays to exercise caution.
While this solicitor email scam is common in the UK and Eire, legal firms in the United States should also exercise caution. Since the conveyancing scam is proving to be lucrative, it will only be a matter of time before U.S. lawyers are targeted.
Cyberattacks on law firms have been steadily increasing over the past three years. According to data from PwC’s annual Law Firms Survey last year, 73% of the UK’s top 100 law firms have been attacked by cybercriminals in the past year. In 2014/2015, 62% of the top 100 law firms were attacked. The previous year the figure stood at 45%. In the past two years, cyberattacks on law firms have increased by a staggering 60%.
According to PwC’s figures, large law firms are the most frequently targeted. 90% of the top 25 legal firms had experienced a cyberattack in the past 12 months. The types of attacks are highly varied, although the most common way attacks occur is via the firm’s email system.
Spear phishing emails are sent to solicitors in an attempt to obtain banking credentials and access to email accounts. When solicitors respond to these phishing emails and divulge their banking credentials, client funds are transferred to the criminals’ accounts. According to the survey, 84% of legal firms said they had experienced a phishing attack in the past year.
Solicitors in the UK and Ireland and attorneys in the United States are also being sent bogus emails that claim to be from home buyers or sellers. Instructions are provided asking for funds to be transferred to alternate accounts. Hackers eavesdrop on email conversations and are aware when funds are about to be transferred. They then sent an email to an attorney/solicitor posing as the buyer/seller of a property and provide alternate bank accounts asking for the funds to be transferred to the new account.
Buyers and sellers of properties are also targeted in a similar fashion. They are sent emails with the hacker claiming to be their solicitor. Alternate bank account details are provided for transfers. This is now one of the main types of cyberattacks on law firms and their clients.
Direct attacks on networks still occur, with hackers taking advantage of vulnerabilities in security defenses. However, law firm hacking only accounts for around 16% of incidents. Malware is a much bigger threat. Malware is delivered via spam email or drive-by downloads from the Web. 55% of legal firms say they have experienced a malware attack in the past 12 months. Malware can be ransomware – which locks computers with powerful encryption until a ransom payment is made or keyloggers that record sensitive data such as usernames and passwords. Malware can also enable criminals to gain access to systems to steal sensitive data and extort money out of law firms.
Law firm cyberattacks can be costly to resolve; however, the biggest cost can be loss of reputation. If law firms suffer cyberattacks and client data is stolen or exposed, reputations can be permanently damaged. Legal firms that are unable to ensure that their clients’ information remains confidential may find the cost of removing malware the least of their problems.
To prevent phishing emails and malware from being delivered to inboxes, an advanced spam filter is required. SpamTitan includes a powerful anti-phishing component that recognizes the common signatures of phishing emails and ensures they are not delivered. SpamTitan also blocks 100% of known malware and ransomware, ensuring end users do not receive malicious email attachments and links to malware-ridden websites.
To find out how SpamTitan can improve your security posture, contact the TitanHQ team today and take the first step toward preventing your law firm from being added to next year’s PwC’s law firm cyberattack statistics.
Anti-phishing training can help an organization improve its security posture. However, even with training on phishing email identification, employees still fail to spot many email scams. Anti-phishing training alone is insufficient to prevent successful phishing attacks.
The Threat from Phishing is Growing
Your business is likely to be bombarded with phishing emails, especially at this time of year. Tax season sees millions of emails sent to businesses by cybercriminals who want access to employees’ W-2 Forms. However, phishing is a year-round problem. It has been estimated that an astonishing 156 million phishing emails are now being sent every single day.
As we have already seen this year, phishing scams can be highly convincing. Many businesses have discovered employees have responded to these scams in the belief that the email requests are genuine. The cost of those phishing attacks can be considerable for businesses, their customers and their employees.
Anti-Phishing Training Alone will Not Prevent Successful Phishing Attacks
To ensure employees are prepared, many businesses provide employees with anti-phishing training. They teach staff members how to identify phishing scams and the tell-tale signs that email requests are not genuine.
How effective is anti-phishing training? A recent analysis by Diligent showed that the average score on its phishing test was 76%. That means employees are failing to identify phishing scams 24% of the time and all it takes is one response to a phishing email for an employee’s email account to be compromised, a network login to be handed to cybercriminals, or the W-2 Forms of an entire workforce to be emailed to tax fraudsters.
Fortunately, as PhishMe’s data shows, with practice, employees get much better at identifying phishing emails. Providing training and conducting follow up tests using dummy phishing emails helps to show where training has failed. This allows organizations to provide further training to employees whose phishing email identification skills are poor. However, even with training and testing it will never be possible to ensure that 100% of employees identify 100% of phishing emails 100% of the time.
The Best Phishing Defense is to Prevent Phishing Emails from Being Delivered
Training should be provided and employees’ anti-phishing skills should be tested with dummy phishing exercises, but organizations should ensure that phishing emails are not delivered to end users’ inboxes. That means an advanced, powerful spam filtering solution is required.
SpamTitan blocks 99.97% of spam emails from being delivered. SpamTitan also includes a powerful anti-phishing component to block phishing attacks. However, blocking potentially malicious emails is only part of the story. It is also important to choose a solution that does not prevent genuine emails from being delivered.
Independent tests by VB Bulletin confirm SpamTitan has a consistently low false positive rate. Only 0.03% of genuine emails trigger SpamTitan’s anti-spam filters. The excellent catch rates and low false positives have seen SpamTitan win 36 consecutive VB Bulletin Anti-Spam Awards.
SpamTitan is available as a gateway appliance or a cloud-based solution, with both requiring minimal IT support. To suit the needs of service providers, the cloud-based version is available in a private cloud and is supplied in white-label format ready for rebranding.
The cost-effective solution is easy to implement, use and maintain and can be used to protect a limitless number of email accounts.
If you want to keep your employees’ inboxes free from phishing emails, malware, and ransomware, call the TitanHQ Sales Team today and say a fond farewell to email spam.
Another school phishing email attack has resulted in the W-2 Form data of school employees being emailed to tax fraudsters. This time, it was employees of Mercer County Schools in West Virginia whose data have been compromised.
The FBI has been called in to investigate the W-2 phishing scam and the IRS has been notified of the incident, while affected employees have been offered services to help them protect their identities.
The school phishing email attack is just one of many such attacks that have occurred this year. While businesses have been extensively targeted in the past, phishing attacks on schools are now commonplace. The problem has become so severe that the IRS recently issued a warning to schools of the risk of phishing email attacks, saying “This is one of the most dangerous email phishing scams we’ve seen in a long time.”
The Mercer County School District phishing attack was almost a carbon copy of many other tax season attacks this year. Already, there have been more than 29,000 victims of these attacks and there is still two months of tax season remaining.
The school phishing email attack involved the sending of an email to an employee in the HR/payroll department requesting a copy of W-2 Forms for all employees that worked in the previous fiscal year. The email was sent from an email account that was very similar to that used by the chief supervisor.
The email contained a slight variation from the genuine email address, which was enough to fool the recipient into thinking the email had been sent from the supervisor’s account. The employee then sent the W-2 forms of 1,800 staff members to the attackers as requested.
Databreaches.net has been tracking this year’s W-2 phishing scams and is maintaining a list of all organizations that have been scammed into revealing W-2 Form data. The list shows that school districts are being extensively targeted. Successful W-2 phishing attacks have been reported by the following schools and school districts in the past 6 weeks:
- Argyle School District, TX
- Belton Independent School District, TX
- Bloomington Public Schools, MN
- College of Southern Idaho, ID
- Davidson County Schools, NC
- Dracut Schools, MA
- Lexington School District 2, SC
- Manatee County School District, FL
- Mohave Community College, AZ
- Morton School District, IL
- Odessa School District, WA
- Tipton County Schools, TN
The Manatee County School District phishing attack resulted in the W-2 Form data of 7,900 employees being emailed to the scammers: The biggest school phishing email attack of the year to date. The Bloomington Public Schools attack also resulted in thousands of employees’ W-2 Forms being disclosed.
There are a number of measures that can be taken to reduce the risk of phishing attacks such as these. Training should be provided to HR and payroll staff and they should be instructed to carefully check senders’ email addresses to ensure the correct account has been used. Policies should also be developed requiring any W-2 Form requests to be verified with the sender via the telephone. It is also essential to implement a spam filtering solution with a powerful anti-phishing component. This will help to ensure that the emails are not delivered. A spam filtering solution will also block malware and ransomware emails from being delivered. The latter types of malicious emails have also been a major problem for school districts over the past year.
Email archiving is essential for most businesses; however, many businesses are not using a cloud-based email archiving solution. In fact, a large number rely on email backups, even though backups are impractical and data loss is a very real concern. But what are the benefits of secure, cloud-based email archiving over backups?
Loss of Email Simply isn’t an Option
Hillary Clinton could easily explain one of the most important benefits of a cloud-based email archiving solution. If an email archive is stored locally, should the device on which that archive is stored be lost or stolen, the entire archive would never be seen again. That is exactly what happened last year.
Donald Trump was quick to citizen Hillary Clinton. Not only was that archive lost, it could potentially have been accessed by an unauthorized individual. Donald Trump is keen not to make a similar mistake. He has reportedly started using a messaging app that deletes all messages once they have been read. Such an app would certainly prevent accidental disclosure, although it would not be an option for many businesses as regulations require emails to be kept for a number of years.
Loss of email is simply not an option in regulated industries. Big fines await companies who do not archive or backup their emails. Emails must be securely stored and made available to auditors or organizations will be in violation of the Sarbanes-Oxley Act, FINRA, HIPAA, and the Gramm-Leach-Billey Act to name but a few. If a backup or local email archive is lost, the consequences can be severe.
Take healthcare organizations for example. If a laptop computer is stolen and email backups containing electronic protected health information were on the device, those data could potentially be accessed by an unauthorized individual. That would be a violation of HIPAA Rules. The Office for Civil Rights could easily fine a healthcare organization millions of dollars for such a data breach. If emails are archived and stored in the cloud, such a breach would not occur in the event of device loss or theft.
Emails Must Be Found Quickly for Legal Discovery
If a lawsuit is filed against a company, it may be necessary to provide copies of emails as part of legal discovery. While many companies store old emails in backups, searching for emails can be a difficult, expensive and long-winded process. For an average-sized organization searching for emails could take weeks, even though emails need to be found in minutes. With an email archiving solution, archived messages can be searched and retrieved in a matter of seconds or minutes, not weeks.
Secure, Cloud-Based Email Archiving Resolves Storage Headaches
Considering the volume of emails now being sent, and the requirement for those emails to be kept for years in many cases, the space required for storing email is considerable. A recent report from Radicati Group suggests the average employee sends or receives 121 emails a day. For an organization with 500 employees that is 60,500 emails a day. With 22 working days each month, that amounts to 15,972,000 emails a year. Each of those emails may only be a few KB, but over a year the storage space required is substantial. Cloud-based email archiving not only allows millions of emails to be stored, there is no need for organizations to purchase any hardware for storage. All emails are securely stored in the cloud.
ArcTitan – Secure, Cloud-Based Email Archiving for Enterprises of All Sizes
The benefits of secure, cloud-based email archiving are clear. So what options are available that provide all of the benefits of cloud-based email archiving in an easy to use, cost effective package? To meet businesses’ email archiving needs, TitanHQ developed ArcTitan – a secure, cloud-based email archiving solution that allows organizations to meet compliance requirements, search email archives quickly, and retrieve messages in minutes. ArcTitan has excellent scalability, and can be used for old email storage by companies with ten to 10,000+ email accounts.
Emails can be archived from anywhere at any time, and messages can be accessed via a mail client or browser. Furthermore, with a pay as you go subscription, cloud-based email archiving is affordable for businesses of all sizes.
To find out more about the benefits of ArcTitan, contact the TitanHQ sales team today!