One very common type of scam is impersonating an individual or a company. When a business is impersonated, cybercriminals often pretend to be employees of that company and focus on scamming regular or future clients of that corporation.
What should a company do in such a situation?
Chinese Clients Fall Victim to Scammers Impersonating SoftGamings
Our brand (SoftGamings) was recently used by an online impersonator to trick our Chinese customers into paying them or providing sensitive data and personal information. Luckily, we were able to act fast and prevent these attacks.
We want to share our experience regarding this in order to help you if your company becomes involved in a similar type of scam.
Send a Warning Message
The first and the most important thing is to send an official warning message to all your clients and potential clients who gave you their email.
The warning message should inform the recipients about the phishing scam related to your company. Explain how cybercriminals work and how they trick clients into paying them.
For example, Chinese scammers used Skype to add our clients and ask them for money and personal info.
Only Use Secure Means of Communication
Use your official email and make sure that you have an email service that uses Sender Policy Framework (SPF) or DomainKeys Identified Mail (DKIM). You should also consider using authentication technology known as DMARC, which stands for Domain-Based Message Authentication, Reporting & Conformance.
Mind you, these technologies cannot help you completely stop criminal operations, but they are definitely something to start with, as your email will become more secure. Moreover, if you use appropriate technologies, your clients will be able to tell the real messages from the fake ones.
Educate Your Clients
Sending a warning message is a great way to let your clients know they might become victims of phishing scams. However, to ensure they won’t fall for the same trick twice, you need to teach them how to detect a fake message or account.
One of the ways to do that is to have a Blog section on your site where you’ll post educational content that will discuss different types of scams. Moreover, you can use your newsletter to send that content to your clients and provide them with useful tips and tricks for achieving security.
No matter how tech-savvy your clients are, they are still human and can make mistakes, so it’s very important to mention that they should always be careful. Remind them not to trust everyone if your company is being impersonated.
Learn About Various Phishing Operations
Sadly, scammers always find new ways to trick people. Every company needs to keep up with the latest phishing tricks and, preferably, educate their clients about them.
When it comes to companies, a very common way of impersonation is typosquatting. Typically, scammers buy domains that have the same name as the company that is being impersonated. The only difference is that there’s a deliberate typo made in the URL. Not being aware of this, clients might click on the link and get scammed, believing they are actually on your company’s site.
But misspelling the company’s name is not the only way to impersonate the site of your company. Sometimes, typosquatters can use a different top-level domain (.org instead of .com) or even use characters written in Cyrillic to make the site look like the original. For example, SoftGaмings looks pretty similar to SoftGamings. In case you haven’t noticed — m is different in the first example as it is a Cyrillic version of the letter.
Final Thoughts
In the end, you have to accept the fact that you cannot stop scams completely. As long as there’s the Internet, cybercriminals will find ways to trick people. There are many phishing techniques out there; your company needs to be aware of them in order to prevent them.
