“Shark Tank” star Barbara Corcoran recently admitted to losing nearly $400,000 due to a convincing email phishing scam. A cybercriminal pretending to be Corcoran’s assistant emailed a fake invoice for a real estate renovation to Corcoran’s bookkeeper. The scam was found out only after the money was wired and the bookkeeper sent a message to the real email address of Corcoran’s assistant to let her know that the payment was made.
Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics
The phishing scam impacting Corcoran’s company clearly debunks the myth that phishing emails are easy to spot. Many companies invest in employee security training to prevent this kind of attack. But as this incident proves, humans are not able to identify malicious emails reliably. Hackers leverage impersonation and heavily researched social engineering tactics to appear as trustworthy senders, and their fraudulent messages are often indistinguishable from legitimate ones. In fact, 83 percent of phishing emails are brand or company impersonations, and another 6 percent impersonate people that the recipient knows.
As this scam illustrates, the consequences of a successful phishing attack are far too high to put the onus entirely on employees. Organizations need to focus on validating and authenticating sender identity. By taking steps like properly enforcing DMARC and employing advanced anti-phishing solutions that confirm senders’ identities for inbound email, organizations can add a crucial defensive layer to their inboxes.