If you work for or own a financial or accounting firm, you need to be aware of a new type of cyberattack known as “whaling.” Whaling has been on the rise over the past few months as cyber criminals aim to steal valuable information and money from these firms.
If you work in finance or accounting and you receive an email from your boss asking you to transfer funds, you might be the victim of a whaling attack. Hackers are using fake or similar sounding domain name emails to trick employees into wiring money out of company accounts and into their own accounts. Most often, hackers will use the CEO or the CFO’s email address.
For example, our email addresses end in @cat-man-du.com so hackers would be using something like firstname.lastname@example.org where “ceo” is the name. These malicious emails are difficult to detect because they appear to come from a familiar source and they contain no attachments or hyperlinks, which we have been trained to be wary of in emails.
According to security firm Mimecast, 55% of the 442 IT professionals surveyed have seen an increase in whaling attacks at their companies.
Hackers get the details necessary to carry out the attack from social media sites like Twitter, LinkedIn, and Facebook. Once they have a target, they send an email that looks like it’s from the CEO. During the emails, they will attempt to get the employee to transfer money or to hand over bank account credentials. The attack is relatively simple to perform, which has attributed to its rise in popularity.
Accounting and financial firms need to be aware of whaling attacks. To protect your company and your money, Mimecast gives the following tips:
1. Be sure to educate senior management, IT professionals, and any other relevant employees about whaling attacks.
2. Hack your own business using whaling techniques in order to see how vulnerable you are.
3. Use internal email stationery that will alert employees if an email has come from outside the company.
4. You can subscribe to a domain name registration service that will alert you if someone creates a domain that is similar to yours.
5. Register all top level domains for your domain if you are able to.
6. Take a look at your finance team and change how payments to third party entities are authorized.