October may have been Cyber Security Awareness month, but that doesn’t mean that the Threat Actors and Hackers out there took the month off. Instead, efforts to make their way into your sensitive and private data were working overtime. We’re seeing spikes in Cyber claims, but the numbers aren’t the only things evolving. Cybercrime is no longer just an Email problem. It’s vastly expanded beyond traditional inbox scams to an all-out assault.
While most of us have become more adept at spotting Phishing emails and malware links that lead to ransomware attacks, these criminals have discovered the art of smooth talking their way into your data. The biggest variable in potential cyber threats is the human element. Exploiting that variable is now as simple as creating a false sense of security by being an active voice on your phone, versus an email you can quickly delete. These targeted attacks have been coined as Vishing, short for “Voice Phishing.”
Vishing is typically conducted by phone calls, voicemails, and voice memos. Ironically enough, as I sat here penning this blog, I received an email from “office phone” that a recent caller “has left you a voicemail.” Luckily, I know that’s an ‘instant report and delete’. By the time you finish reading this, you’ll pause before clicking on those voicemail messages too.
Vishing Threat Actors take on many roles – they may call you on a spoofed phone number that you recognize, and they may impersonate trusted individuals or companies. They may tell you that they’re calling you from your bank, from a vendor, or even pose as a member of your own company’s IT team. Their goal is to gain your trust quickly so that you provide them with the keys to the castle. They may ask for Multi-Factor Authentication tokens, get you to transfer money to them, or allow them enough information to hack your banking information. Many times, the long-term goal isn’t just to get into your systems; it’s to exfiltrate your data and then engage you in a ransom scenario, all without ever touching your computer.
In the age of AI, there are a whole new set of concerns that come along with Vishing. Voice cloning and AI generated audio can engage a whole new level of trust in the person on the line. This can lead you or your employees to believe that you are following legitimate instructions from someone you know and trust. They may create a sense of urgency or fear in not responding before you have a chance to think it through and weigh out the consequences.
These schemes can have serious consequences for individuals and businesses. Fraudulent vendor or invoice payments may leave the original bill unpaid, requiring a second payment. They can also lead to network intrusions or ransomware attacks, causing costly business interruptions and significant reputational damage. If a breach compromises client or contact data, the added legal implications and notification requirements can make the situation overwhelming.
Recognizing the red flags can help you stay in control of your systems and data. There are often warning signs: unexpected calls requesting sensitive information, unusual urgency or pressure to act, specific instructions to not discuss the conversation with anyone else, and unfamiliar requests from someone you know and trust – even if it sounds like they’re the one making them. Always remember, you cannot just rely on caller ID, because a spoofed number may come up as a contact you already have in your system.
If you receive a call that feels “off”, the best thing you can do before engaging in the call is to ask for a call back. If a spoofed number calls you, but you dial the actual number back, spoofing does not enable inbound calls to that number to be intercepted.
If you find yourself on the wrong end of one of these calls, notify your IT department right away so that they may attempt to cordon any access the Threat Actor may be attempting to gain. If any financial information or wire transfers have occurred, you should call your financial institution immediately, and report the incident on www.ic3.gov, the internet crimes division of the US government. Additionally, contact your insurance broker, because there may still be coverage under your Cyber or Crime policy.
The takeaway: Your biggest Cyber vulnerability may not be your technology. It may be the person answering the phone. Trust is valuable. Verification is priceless. If you want to ensure that you have adequate coverage for this and other Cyber losses, reach out to your Sentinel team today. We’re built to be more than a broker, and we won’t just leave you hanging on the line when cybercriminals come calling. We’ll help you stay one step ahead of the threats, so the only thing you’re left listening to is the sound of security
