With an unprecedented number of people being told to work from home for the foreseeable future following the Government’s guidance on Coronavirus (COVID-19), many organisations may be at increased risk of cybersecurity threats such as phishing attempts and business mandate fraud. 

As of 20th March, Action Fraud reported total losses of almost £970,000 across the UK. This number is likely to rise in the near future with the propagation of fake information about COVID-19, which appears to be spreading faster than the virus itself. This is why companies need to take extra steps to minimise the risk to themselves. Paul Chichester, Director of Operations at the National Cyber Security Centre (NCSC), said: 

We know that cybercriminals are opportunistic and will look to exploit people’s fears, and this has undoubtedly been the case with the Coronavirus outbreak. Our advice to the public is to follow our guidance, which includes everything from password advice to spotting suspect emails. In the event that someone does fall victim to a phishing attempt, they should look to report this to Action Fraud as soon as possible.” 

Given the sudden and somewhat unexpected change to the circumstances of many employees, cybercriminals are attempting to exploit this change with phishing emails. While some phishing attempts can be obvious, others are not.  These fraudulent emails will have attachments or links which the user is requested to review or click on as a matter of urgency. This is designed to pressure an employee into complying with seemingly genuine request. 

There has been an increase in multiple forms of phishing attempts with the current COVID-19 global pandemic. Security researches have shown that attempts impersonating the World Health Organization (WHO), HM Revenue and Customs (HMRC) and other companies have been used to try and trick unassuming individuals into clicking on malicious links or attachments. 

Another way attackers are trying to phish for peoples information is via SMS messages which appear to be from legitimate sources. There has been a spike in fraudulent texts from ‘HMRC’ and ‘GOV_UK’ relating to COVID-19 tax rebates and fines or breaching government guidelines respectively. 

Here are some methods used by attackers: 

  • An email is received changing bank account details. 
  • An email is received containing a fraudulent invoice where payment is requested. Sometimes the invoice is missing the company logo or is a poorly scanned copy of an invoice. 
  • An email is received from what appears to be a legitimate contact but with a slight change to the sender’s address such as “joe.bloggs123 @ email.com” being changed to “joe.blogs123 @ email.com”. 

Here are some ways to protect yourself from falling victim to phishing attacks: 

  • Never let yourself feel pressured into clicking a link in an email. 
  • Don’t be taken in by the sender’s name. This scam may say it’s from “World Health Organization”, but this field can be altered by the attackers to appear genuine. 
  • Look out for spelling and grammatical errors. This is one of the most obvious telltale signs that they’re fraudulent. 
  • Check the URL before you type it in or click a link by hovering your mouse over the hyperlink or button. If the website link does not match the URL shown, avoid clicking on the link. 
  • Turn on two-factor authentication (2FA) if you can. This additional security step is critical in preventing hackers from gaining access to your accounts as they will not have access to your phone. 
  • Educate your users on how to spot phishing emails and email phishing techniques, particularly finance departments.