Navigating the online world safely has become an effort well worth the task. With a significant swell in the number of those working from home, come the most historic levels of hacking the world has ever seen. Research shows the cost of ATO fraud saw a 72% rise, resulting in a $16.9 billion price tag overall, with consumer out-of-pocket costs hitting $3.5 Million. Account takeover (ATO) fraud attacks have been growing yearly, accounting for much of the identity fraud-based financial losses to consumers and businesses. ATO fraud can lead to empty bank accounts and damaged reputations, and those recovering from an attack find it’s an expensive, time consuming, and frustrating task.
Anatomy of ATO Fraud
A successful ATO attack uses deception to work and tricks us into handing over our personally identifiable information (PII) or take direct actions that lead to ATOs. With just a bit of exposed PII (thanks to prior data breaches and social media posts), hackers can launch socially engineered email attacks. These are highly targeted phishing emails that abuse the data gleaned from online posts and other sources. The information is easy to find when user’s post too much information on social platforms. They have no idea it can be abused and used to launch an ATO fraud attack.
Knowing how to spot ATO fraud attacks is just as important as knowing what they are. A user who knows how to avoid ATO fraud would be downright annoying to hackers…so let’s do it!
YOUR DATA IS OUT THERE
Thanks to hackers, mega data breaches aren’t rare anymore so be aware of them especially when you have an account with the compromised business. If so, change your username and password immediately. Unfortunately, the exposed data includes usernames, passwords, account numbers, credit card numbers, and more. The heisted data ends up on the dark web and is easily accessible to cybercriminals. Be cyber-smart about how much personal information you post online, especially when that post is on social media platforms. Any details about you, whether written or in pictures, inadvertently exposes your PII. Hackers who troll these sites scoop up the details and use them against you and others.
SOCIAL ENGINEERING AND YOUR DATA
The social engineering part of ATO fraud happens when hackers send the target victim emails using the names of their friends, family, co-workers, special interest groups, and anything else that might grab the target’s attention. When the sender is already trusted, victims are likely to lower their guard and do what the email requests. Socially engineered ATOs often send highly targeted emails that have malware attachments to open or follow bogus links in the text. Once the ATO is put in motion, hackers have free reign over the victim’s identity and the account no longer belongs to the victim. Financial fraud is sure to follow when 40% of ATOs happen within 24 hours of a criminal taking over an account; often long before a victim realizes their identity and their money are stolen.
THINK FIRST, ACT LATER
Beware of emails asking you to act in some way that could benefit a hacker. Even though it appears to be from a trusted source, it could be socially engineered. Don’t hesitate to confirm the email is from the sender they claim to be, especially if has attachments or links. Call the sender directly and never use contact information provided in an email. If the email is from a company like your bank or Amazon, go directly to the website yourself and confirm if your information is truly needed.
STRONG PASSWORDS CAN SAVE THE DAY
Always use strong, long passwords with a combination of letters, numbers, and symbols. Never reuse them on multiple sites, because hackers use credential stuffing, password spraying, or password cramming tools. These tools take passwords stolen from an account and tries them on other accounts you have. With 71% of users reusing their passwords, the hope is that you’ve used the same password for other sites too. So, bolster your passwords and don’t hand cybercriminals easy access to more of your accounts.
ROADBLOCKS PLEASE
Never make it easy for bad actors to get your PII. If you put up enough cyber roadblocks to it there’s a good chance a hacker will simply move on to an easier, less protected target. Remember “Don’t Trust and Verify First” for emails and other messages. This is especially important when an email asks you to act in some way that could expose your PII or get you to open attachments or follow links. They’re all part of a hacker’s tool kit and a big part of enabling ATOs, so use your cyber-smarts and avoid becoming the next victim of ATO fraud.
SUBSCRIBE TO WEEKLY NEWSLETTER
