With national lockdowns prompting millions of people to work from home, employees around the world have faced considerable challenges in recent months. For one thing, people have had to carve out workspace in their homes, often while juggling childcare and home education. At the same time, a sharp rise in cybercrime has made it more critical than ever for companies to ensure that employees take all necessary steps to protect themselves and their businesses from a cyberattack.

Indeed, a report published by Interpol in July 2020 noted that in the Americas, “cybercriminals are increasingly targeting employees in order to gain control through remote access to corporate networks with a view to stealing sensitive information.”

“The world of cybersecurity has drastically changed,” comments Joseph Krull, Senior Analyst at Aite Group. “Organisations have done a good job of trying to get people up and working as quickly as possible, and reduce that risk – but from everything we’ve seen, there has been a huge increase in prevalence of scams, phishing attacks and ransomware. It’s like a hockey stick.”

In with the new

Cybercriminals are nothing if not opportunistic – so COVID-19 has resulted in a new selection of scamming strategies, with cybercriminals seeking to exploit public concern about the pandemic. According to the Interpol report, two thirds of member countries in Europe “reported a significant increase in malicious domains registered with the key words ‘COVID’ or ‘Corona’ aiming to take advantage of the growing number of people searching for information about COVID-19 online.”

Scammers are also taking advantage of the crisis with emails purporting to help people apply for government benefits, Krull comments. He also notes that scammers have had considerable success in posing as contact tracers and informing people that they have been exposed to COVID-19. “The first thing they ask you for is your national identity number and credit card details – they say, ‘you’re going to have to get tested, and I need a deposit from you before you go to the testing site,’” he explains.

Treasurers and cybersecurity

Given the sensitivity of most treasury activities, corporate treasurers need to be particularly vigilant when it comes to mitigating the risk of a cyberattack. Of particular concern are business email compromise (BEC) scams, which accounted for 61% of the actual or attempted fraud reported by treasurers last year, according to the 2020 Association for Financial Professionals Payments Fraud and Control Survey.

Fortunately, there are a number of actions treasurers can take to protect themselves and their companies. Krull says the following considerations are particularly important:

• Protect your machine. If you’re responsible for processing transactions, don’t use the same machine for risky behaviours such as downloading a movie from an unofficial site or playing an online game.
• Be alert for BEC scams. Krull notes that BEC attacks have been picking up steam recently. He cites a recent report by phishing defence solutions provider Agari, which claimed that a Russian cybercriminal ring has turned its attention to social engineered phishing attacks, which tend to be more lucrative than ransomware and malware fraud.
• Education is imperative. In the office environment, Krull says, it’s easy enough for people to consult a colleague in the next cubicle about a suspicious email – but in a remote environment, people tend to be more reluctant to pick up the phone or email a colleague. Instilling the right behaviours is therefore more important than ever.

While many companies will be using a virtual private network (VPN) to protect data, Krull warns that this can provide a false sense of security. “If your machine is connected to the internet, and you’re connected to the VPN at the same time, you have what is called split tunnelling – you bring in all the mess from the internet, and you can extensively infect your environment across the VPN,” he says.

Likewise, with many companies beginning to use cloud tools for the first time, Krull notes that if people are not fully conversant in the necessary controls, they can open themselves up to the risk of attack.

Looking forward, the opportunistic nature of cybercriminals means it is likely that as people begin to return to the office, new scams will appear that seek to harness this shift in some way. “I haven’t seen this yet, but I’m fully anticipating this being the next thing,” Krull concludes.