Businesses face a growing number of cybersecurity threats. One particularly dangerous tactic used by cybercriminals is social engineering — manipulating people into divulging confidential information or granting access to systems under the guise of legitimate requests. Recently, we encountered a concerning example of this, and it’s crucial that you and your team stay vigilant.
The Story: A Close Call with a Scam
Last week, I received a call from someone claiming to be from Intuit QuickBooks, informing me of an issue with our updates. This immediately raised a red flag, as we use the online version of QuickBooks, making such a call unexpected. However, I decided to play along to understand their angle.
The caller asked me to check for a specific update button or alert, which, unsurprisingly, was not visible on our interface. They then suggested a remote support session and directed me to visit a website, https://support.me. This was another red flag. I refused and instead suggested using QuickBooks’ official SmartLook feature for support. The caller hesitated and put me on hold, claiming they needed to consult a manager. When they returned, they asserted that SmartLook was no longer an official support method. This was the final nail in the coffin — this was undoubtedly a social engineering attempt aimed at gaining unauthorized access to our systems.
While the website the caller directed me to is not inherently malicious, the real danger lies in who you allow to access your system through it. Had I followed their instructions, the scammer could have gained control over my computer, putting our entire network at risk.
Why This Matters: Social Engineering in Action
Social engineering attacks like these are designed to prey on human trust and can easily deceive even the most cautious staff. In this instance, the scammer used a combination of legitimate-sounding terminology and urgency to create a sense of trust and immediate action. It’s a stark reminder that no matter how secure your systems may be, your team members are the last line of defense.
How to Protect Your Business
Here are a few critical steps you can take to safeguard your business against such threats:
- Cybersecurity Training: Ensure your staff is trained to recognize social engineering attempts. Regular training sessions can help employees identify red flags and respond appropriately to suspicious requests.
- Remove Local Administrative Privileges: By limiting administrative access on employee computers, you reduce the risk of unauthorized software installations and potential breaches.
- Be Wary of Unsolicited Calls: Always be cautious of unsolicited calls, especially those requesting remote access or installation of software. If something seems off, trust your instincts—disconnect and verify the request by contacting the vendor directly using an official number, not one provided by the caller.
- Communicate Internally: Ensure that this information is shared widely within your organization. The only way to stay ahead of these threats is to keep everyone informed and vigilant.
Reach Out to Us
If you have any concerns or if something doesn’t feel right, don’t hesitate to reach out to our team. We’re here to support you and can provide further guidance on how to protect your business from these kinds of threats.
Do You Need Help With Your Cybersecurity?
Navigating the landscape of cybersecurity can be challenging. That’s why we’re here to offer our expertise. Schedule a call with us to discuss how you can build a robust cybersecurity framework that prioritizes your company’s safety without breaking the bank.
We’ve assisted numerous businesses in fortifying their defenses, helping them stay resilient in the face of growing cyber threats. Currently, we’re partnered with companies who have reported a huge decrease in risk and a massive gain in peace of mind. In addition to their security being sound, they have also enhanced their operational efficiency because of our partnership.
Let us help you establish a robust cybersecurity plan and devise a step-by-step action plan to bolster your defense capabilities.
