Businesses Beware OF Fake Meeting Requests

Hi,

Important that we meet discuss speerfishing attacks over business comunicatons. We need to make plan about this IMMEDIATELY. Please click on the link [uurl.callender.com] to make an appointment with IT for quick tutorial.

Regards,

IT

There are several things wrong with this email, and hopefully, you noticed them. All are red flags you can look for to avoid fake meeting requests or calendar-invite scams.

Business Email Communication (BEC) scams are not new. For example:

  • Facebook and Google suffered a $121 million BEC scam.
  • Ubiquiti lost $46.7 million to an attack.
  • Toyota transferred $37 million to crooks in a BEC snafu.

In 2020, BEC attacks were the most lucrative scam. The US estimated cybercriminals made over $1.8 billion with this approach. Beyond money, falling victim to a BEC attack also costs your business time and reputation. Here’s what to look for and how to protect against BEC scammers.

How BEC Scams Work

With many more people working from home and meeting virtually, there’s been an uptick in BEC spearfishing attacks.

On Gmail, the bad actor needs only your email address to send an invite that adds to your calendar by default. Then, you might click on what appears to be a meeting link, which actually takes you to a malware site.

Zoom has also become an attack vector. You get an invite to a meeting that asks you to login into Microsoft Outlook. You’ve done it so many times before, except this is a fake login page, and it’s set up to steal your access credentials.

How to Protect Against BEC Scams

Educate your users. As with any other type of email scam, users need to learn to be careful about the links they click. Some indicators to look for, which you can see in our opening example, include:

  • spelling mistakes;
  • urgent appeals;
  • poor phrasing;
  • suspicious links.

Email addresses, links, and domain name inconsistencies are more bad signs. Plus, be wary if something seems too good to be true (a free laptop?) or is an unusual request (transfer $1 million from the CEO’s account).

Google Calendar users can go into General settings, then Event settings, and switch off “Automatically add invitations.” Instead, select “No, only show invitations to which I have responded.” Also, under Events from Gmail, you can stop calendar events auto-generating based on your inbox. Keep in mind, though, that you’ll also be blocking legitimate events.

In these days of the hybrid workforce, we’re used to clicking on links from Zoom, Google Docs, and Microsoft Office as part of our daily workflow. The cyber bad guys know this and are taking advantage of it. Unsubscribing from email lists, keeping your email private, and reporting spam to IT can all help.

Your business might also benefit from working with a managed service provider to use a third-party spam filter. Our experts can also review your cybersecurity posture and identify areas to improve your defenses.

Contact us today at (416) 848-6218 or 1 (888) 268-2564.

More To Explore

We Love to help

We’re dedicated to offering you the best services for your business. Whether you need a one-time solution or ongoing support, you can count on us to get the job done well. Even if you don’t quite know what problem you are looking to solve, our outstanding team is standing by with all the solutions in-hand. Complete the contact form below and start erasing your problems.

Is Managed Service a good fit for my business?

If your business is among those that require efficient, sophisticated technological guidance and protections, the ongoing support of an MSP can be a game changer.

If you’d like to learn more about the types of managed services that we offer, contact us directly

We Are A Company Made Up Of People Who Love What They Do.

Combining an extensive set of individual talents and over 30 years of professional IT experience, our team has come together with a shared goal: serving small businesses.