With GDPR coming into force and thousands, if not millions, of privacy policy and data protection emails being sent out in the run-up to the deadline, most of us are probably sick of being asked about our marketing preferences. But while the resultant apathy might be bad news for marketers, for cyber criminals, it represented an opportunity.
On 3rd May, numerous technology news sites, including ZDNet, reported that GDPR-related phishing emails were being sent out to businesses, purporting to be from Airbnb. Because new data laws were coming in, the emails claimed, it was necessary for prospective guests to update their personal data – including login information and card details. Anyone who filled in the bogus forms would have their data - and maybe money from their account - stolen.
This was no isolated incident either. Natwest customers, too, reported receiving phishing emails as well, and the Telegraph warned there were more of these scams doing the rounds.
Such opportunism isn’t new among criminals, of course. After pretty much any natural disaster, for example, you’ll get fraudsters setting up fake charities or finding other ways to profit from other people’s suffering.
Cyber crime, while sounding sophisticated and technical, is often based on little more than the use of old-fashioned confidence tricks and social engineering, to get people to hand over personal information or money. Of course, high-tech, targeted attacks do occur, and there are truly skilled coders creating malware and hacking tools, but most cyber crime is committed by people with limited technical abilities.
No doubt, this is why phishing is so common. It doesn’t require amazing computing skills to send out emails, and criminals simply rely on human error and gullibility to make their scams work.
And it’s not just your email you have to worry about. Clickbait articles based on current events are another favourite of scammers, who will tempt users of social media with fake articles that promise shocking, salacious or exclusive information related to the latest news stories. These, however, exist only to steal personal data, which can then be sold or used in other crimes.
The same safety considerations as always apply, of course, like checking that emails are really who they purport to be from, not downloading attachments from strangers and being careful about clicking links if you don’t know where they go to. But in addition to these things, you should be aware that big public events and incidents will naturally be followed by unscrupulous criminals, looking to exploit them for their own ends.
In fact, any situation in which people might be vulnerable will likely attract fraudsters, and technology is just one tool of many that they might use to trick you. In all cases, it pays to be vigilent and to be skeptical of anyone who asks you for personal data or cash.
Would the people in your business fall for a phishing attack? Find out with TMB security awareness training.