There is something almost comical about hackers targeting some of the world's most heavily protected financial companies with one of the oldest tricks in the book: They simply make a phone call.
Google security researchers recently reported a campaign targeting dozens of major U.S. financial institutions and other businesses. The criminals used phone calls to impersonate IT help-desk employees and convince workers to provide information that could give the attackers access to company systems.
Among the organizations reportedly targeted were major financial firms including Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, and Moody's.
"Hi, I'm From IT"
The scam starts with a phone call. The attacker pretends to be someone from the company's technology support team and tells the employee there is a problem that needs to be fixed.
The employee may then be directed to a website that looks legitimate but is actually designed to steal login credentials and authentication information.
Once the criminals get inside, they can steal sensitive information and potentially use it to extort the company.
It's a reminder that sometimes the easiest way into a well-protected computer system is through the person sitting in front of it.
And This Matters to You
You might be thinking, "I'm not an employee at a billion-dollar investment firm, so why should I care?” Well, it’s because the technique is remarkably transferable.
Imagine receiving a call from someone claiming to be from your financial institution (FI). They tell you there has been suspicious activity on your account. They sound professional and they know your name.
They ask you to confirm a code that was just sent to your phone. But THAT’S the moment to stop.
Your FI should never need you to give a caller an authentication code to "protect" your account. And if someone calls unexpectedly claiming to be from your FI, don't trust the phone number simply because it appears legitimate. Caller ID can be spoofed. Hang up and call the bank using the number on the back of your debit or credit card, or from looking it up on the official website or app.
The Bottom Line
Cybersecurity doesn't always look like a hacker hunched over a keyboard in a dark room.
Sometimes it looks like a friendly person calling to “help." That's what makes this campaign particularly important. The criminals aren't necessarily trying to outsmart the technology; they're trying to convince someone to let them through.
And that is a trick that works just as well on Main Street as it does on Wall Street.
SUBSCRIBE TO WEEKLY NEWSLETTER
