Scottrade 2013-2014 Data Breach May Cause Increase in Phishing, Vishing, and Spearphishing

Financial Services Company, Scottrade was the victim of a data breach from late 2013 to early 2014 and this one may have affected 4.6 million customers.  The information stolen included names and addresses. It is important to note that no trading information or client funds information was accessed in this incident. In addition, no customer passwords were accessed and Scottrade has said that all passwords were fully encrypted at all times during the intrusion.

Although no sensitive data such as trades and account data were breached, this is an indicator of how cybercrime rings may now be limiting the information they steal in any given incident and collecting it behind the scenes. This may be preventing them from being tracked down, as the significance of the data may not be considered so valuable. However, over time they can collect it and piece it together like a puzzle. What they do with it may include creating profiles of individuals for more nefarious reasons, or using it for targeted phishing or vishing schemes. As is potential with instances like the OPM, White House and other government-related intrusions, the more information they have, the more possibility that spearphishing will be a preferred method of obtaining money and information.

It is getting exceptionally important for everyone who interacts with any person or program online to become more sophisticated about identifying phishing, vishing (phishing over the phone), or spearphishing (targeted phishing toward a particular person or industry, often in the financial services or government spaces who have desired access levels to sensitive information).

There are always signs of a phishing email or phone call. They are not always easy to spot, so it is especially important to watch for them when information was taken from a company that has any relationship to your financial data. Look out for the following warning signs:

• An email sent from a financial institution or financial services company asking you to click a link or open an attachment to update something or view a policy. These companies will ask you to log into your account to make changes or read revised policies.

• Often times there are links in any email sent to a mass quantity of users. However, it us normally a link to unsubscribe or report something. In those cases, should you want to or need to get to those places, hover over the link to make sure it’s going where you think it should. Better yet, go directly to the company’s website and find the information there. Manually typing addresses into the browser is recommended.

• Many times, phishing email messages are sent by those who are not proficient in the language of the users they are targeting. Phishers may also struggle with correct use of grammar, make typos, and not punctuate correctly. While many native speakers also struggle with this, professional organizations typically make sure their messages do not get sent that way.

• Phishers will try to copy logos of the organizations they are spoofing, but often just don’t quite get it right. Check the logos, addresses, and image quality of the message. If these are poorly done, askew, or formatted a little strangely, it’s a flag.

• Vishers will appear pushy and make you feel like it’s critical you make a decision immediately. They don’t want to give their victims time to think about what they are asking them. Never give payment card, social security number, or any other sensitive details to someone who calls you on the phone. Instead, find a phone number directly from a previously documented or bookmarked location and initiate the call.  Don’t use any number or email address provided from the caller.

• Spearphishing is especially dangerous. The FBI has defined them as email messages from organizations that ordinarily would contact the potential victims, which makes them even more deceptive. The criminals need a limited amount of information to write a script, such as a name and address and a place of employment to be successful. Keep that information to yourself and whenever in doubt, contact the organization directly through another means. Don’t use any information found in the email message to get in touch.

The information gained in any intrusion provides value to the attacker, even if it may not be immediately obvious as to their plans. So, any time you are included in a breach, watch your payment card details and monitor credit report. Let the issuing organization know right away if you spot anything suspicious.

Scottrade was notified of the breach by U.S authorities when investigating cybercrimes and thefts.  It is recommended that all passwords be changed, even though they were not included in the breach. If your information was included, you should be getting a notification from Scottrade directly.