According to data, businesses lose over $700 million a month because their employees fall victim to phishing attacks, bec scams, and other frauds. What's worrying is that the financial losses appear to be increasing.
Hackers targeting money often use phishing and impersonation to trick company employees into handing over hundreds of thousands of dollars. But new data shows that cybercriminals are now asking victims for gift cards that can be worth as little as $250.
Agari researchers said in their report that gift card phishing scams increased in late 2019, accounting for 62% of all BEC attacks.
In these types of attacks, criminals gain access to an employee's account and, using the stolen credentials, send emails to other people in the organization requesting the purchase of gift cards.
Typically, hackers impersonate a company and ask an employee to do them a favor. Employees are unlikely to refuse a favor from their superior. Gift card scams are especially common during the holiday season.
The average amount hackers are demanding via cards has increased to $1,627. The minimum amount is as low as $250. In some cases, cybercriminals have demanded gift cards worth $10,000. In these cases, hackers targeted multiple employees at once.
Gift cards are very useful for criminals because they can be redeemed immediately. Hackers also get the cards for free, at the victim's expense, and can then sell them.
Typically, gift cards are requested for: Google Play, eBay, Target, iTunes and Walmart, Best Buy, Amazon, Steam and Apple Store.
The value of the cards may be considered small. But these attacks have increased. Therefore, the total money lost is large.
Of course, there are also the more traditional BEC attacks, which ask victims to transfer large sums of money. According to experts, attacks have increased in the last quarter.
These attacks are a bit more complicated for criminals. They often need to break into their target's inbox and monitor their contacts and communications in order to impersonate a specific person and request a large sum of money to be transferred.
The average amount of money requested in these scams is $55,000. Sometimes, attackers even ask for hundreds of thousands or millions of dollars. However, when excessively large amounts are requested, suspicions arise.
Criminals prefer phishing and BEC attacks because they are very successful and usually simple. However, organizations and companies can protect themselves by taking more security, such as multi-factor authentication , etc.
“Businesses need to understand that cyberattacks are no longer particularly complex. Most attacks today, such as BEC, are very simple social-engineering attacks , and businesses need to make sure they have the right defenses in place to deal with these types of attacks,” said one researcher.
