Social Engineering Fraud: Keep Your Business Safe in the Digital Era

Social Engineering Fraud: Keep Your Business Safe in the Digital Era

Here in Australia, a cybercrime report is made approximately every eight minutes. With nearly every business existing in the digital space, this is an extremely alarming statistic that indicates a lot of companies are at risk.

Australia’s lead cyber security agency (ACSC) has recently issued a warning that Australian businesses may be the inadvertent targets of Russian-linked cybercriminals due to the current events in Ukraine.

Owning your business is both rewarding and challenging, requiring extensive time, energy and money. However, the fast-paced transition of businesses into the digital world has proven to be another hurdle, creating both opportunities and new or different threats. Unfortunately, cybercrime reports again increased by nearly 13% over the last year.

Cybercriminals are getting more sophisticated each year, and people and companies are increasingly falling victim to cybercrimes, including ransomware and social engineering fraud, and not realising until it’s too late. While we are becoming more media literate and aware of potential cyber risks, social engineering attacks are increasingly the preferred method of cybercriminals.

As mentioned, the digital world is increasing its reach into most areas of our lives, from food deliveries to buying goods online. This leaves a lot of ways that people and companies can be exposed. As good as your preparation and defences are, cybercriminals may gain access through a supplier or employees not following security procedures.

Cyber risks and social engineering fraud are not usually covered under the normal business insurance policy, so they have to be looked at separately.

Social Engineering Fraud: Keep Your Business Safe in the Digital Era

What is Social Engineering Fraud?

In simple terms, social engineering fraud is when a cybercriminal tricks a person into sharing confidential information or transferring funds, which they then steal.

While it is common knowledge that cyber scams can be ruthless, this type of fraud is rather insidious.

Social engineering fraud relies on manipulation. These scammers generally operate via email and target people with access to systems of bank accounts within the business. However, anyone or any company is potentially at risk. Their process relies heavily on human interaction and finding a software patch or the person responsible for paying invoices in the business being tricked that an urgent payment instruction is from a (fake) business owner. Scammers often do a lot of work behind the scenes to gain access to and monitor your internal communication and can cleverly convince you they are someone you know and trust.

Another example of a social engineering attack is a phishing email that impersonates someone within your company or a business you do business with, that requests banking and payment details or urgent payments to be processed. Extra pressure is generally applied for you to respond by a specific time, playing into human nature, where people want to be helpful and help respond quickly.

Unfortunately, these types of scams can and do frequently go unnoticed until the funds have been transferred and it’s too late to recover them.

Types of Social Engineering

Social engineering fraud is difficult to identify and far from black and white. However, it can be either of two common fraud types,

Human-based:

Involves person-to-person communication such as:

Impersonation,
Posing as an authorised user (like your boss),
Posing as a third-party stakeholder,
Shoulder surfing to gain private credentials, and;
Dumpster diving to check your computer's trash for valuable information.

Computer-based:

This approach generally targets victims via computer software, often achieved by

Phishing campaigns (email scams designed to steal personal information),
Baiting (enticing victims to click malicious links or download malware), and;
Online scams.

Cybercrime vs Social Engineering

It’s important to know the main features of social engineering fraud, which is a type of cybercrime. By knowing these features you can understand the risk to your specific business and put into place risk controls to reduce or prevent damage from these types of attacks. Getting the right advice and purchasing the right insurance is key to managing this risk and protecting your business from the financial impact and helping you get back to business as normal.

Traditional cyberattacks involving fund transfer fraud rely on an indirect approach. It involves a malicious system attack or hack that enables the attacker to use the victim’s banking information to transfer funds. The hacker often has to attack a network and directly steal usernames and passwords with no involvement with the victim.

As a result of most typical cyberattacks, the victim doesn’t even realise what has happened until the damage is done. So, the difference with social engineering fraud is that the victim has not played any direct part in the attack.

Social engineering scammers often work by being in direct contact with and tricking an employee (the victim) to hand over information or transferring money. This is often called voluntary parting of title and is not the same as cybercrime because although it was inadvertent, the victim played a role in the scam, authorising a money transfer or providing information while being scammed.

Who in the Business is Most at Risk?

While anyone can be the subject of social engineering attacks, there are certain groups scammers typically target. This is due to factors including seniority, access to sensitive information, or ability to access systems and authority, such as:

High profile individuals,
Senior management,
System administrators, and;
Staff members (mainly from sales, marketing, finance, legal, etc.).

Ultimately, no matter what your position is within the organisation or existing cyber defence, no one is immune to being scammed and becoming a victim of social engineering or cybercrime.

Understand and minimise your risk

While it is impossible to eliminate your risk of becoming a target for social engineer scammers and cybercrime in general; there are procedures you can put into place to minimise the consequences of cybercrime or social engineering fraud. This includes:

Implementing policies that require a two-stage person to person confirmation before payments are made to new accounts or changes are made to existing accounts,
Ensuring your business has up to date IT security protection,
Continuing educating staff on social engineering and the latest types of cybercrime, and;
Investing in social engineering insurance.

In Summary

While you can take practical steps to minimise the risks and financial consequences of cybercrime with security and staff training, cybercriminals are good at what they do and are always looking for weaknesses and gaps.

A key defence to ensure that the financial loss is minimised is to ensure the right insurance cover is in place. Social engineering is an area where companies are commonly underinsured due to the misconception that they are already covered for cybercrime under standard policies like management liability or public liability insurance.

Social engineering fraud and cyberattacks are a constant financial and reputational threat to your business, So, investing in the right insurance policy coverage is an easy way to manage a potentially catastrophic financial risk. The policy can also pay for lost profits, new software and PR help.

Different policies provide different levels of protection. You can contact your nearest insurance adviser for more information. Our team of professionals are dedicated to working with you to manage the risk and find the best policy for you and your business.

Important Information

This communication including any weblinks or attachments is for information purposes only. It is not a recommendation or opinion, your personal or individual objectives, financial situation or needs have not been taken into account. This communication is not intended to constitute personal advice.

We strongly recommend that you consider the suitability of this information, in respect of your own personal objectives, financial situation and needs before acting on it. This document is also not a Product Disclosure Statement (PDS) or a policy wording, nor is it a summary of a particular product’s features or terms of any insurance product. If you are interested in discussing this information or acquiring an insurance product, you should contact your insurance adviser to obtain and carefully consider any relevant PDS or policy wording before deciding whether to purchase any insurance product.

Cyber Insurance

Technology has never been so deeply entwined in our businesses. While it delivers significant efficiencies and convenience, it also comes with significant cyber risks.

Cyber Insurance

What is Cyber Insurance?

During the 2020-21 financial year, the Australian Cyber Security Centre (ACSC) observed self-reported losses from cybercrime in Australia totalling a staggering $33 billion. Most businesses rely on technology to some extent, which means they’re exposed to increasingly sophisticated cybercriminals. According to the ACSC, an average of 164 cybercrime reports are made by Australians every day – that's about one report every 10 minutes.

Cyber Insurance covers the physical loss or damage to information, IT systems and networks. It can also cover loss of profits to be business, caused by the introduction of malware, extortion or hacking, as well as management of the incident itself.

Why is Cyber Insurance important?

Businesses must have guards against hackers and other types of cyber breaches. What’s more, because of stricter data privacy laws, they’re increasingly required to ensure personal information is secure. A breach will be investigated and require costly actions, including contacting hundreds or thousands of customers. There’s also the potential for hefty fines and penalties.

It’s easier to buy an insurance cover that protects your main cyber-related risks of damage to your systems and recovery, rather than trying to find specialist consultants to rebuild systems and keep the business operating. Cyber Insurance policies also generally include significant support with managing the incident, which can be essential when faced with reputational damage or regulatory enforcement.

What does Cyber Insurance cover?

There is a wide range of Cyber Insurance available. While all policies cover liability to third parties for passing on viruses, some also cover damage to your own networks.

Additional sections that we recommend considering include:

incident response – specialists to identify the issue and repair
lost income and additional costs related to the incident
data recovery and restoration
consumer notification costs and ongoing monitoring costs
legal defence costs
cyber extortion management and fees
crisis and PR management of the incident
management of communications with regulators.

Managing cyber risks to your business

Cyber Insurance is a key part of your management of cyber incidents and attacks. Many resources are available to help minimise the likelihood of a successful attack, including the Australian Cyber Security Centre.

The top 3 things that you can do easily are:

Update your devices to protect information.
Set up multi-factor authentication for logging on.
Back up your data real-time of at least daily.

Explore your insurance options today. Talk to your professional insurance and risk adviser and get the best cover for you and your risks.

Frequently Asked Questions

What is not covered by Cyber Insurance?

Like any insurance, not everything is covered by your policy. Some common exclusions include:

personal injury
consumer redress funds, unless specifically covered
loss of money or securities, unless specifically covered
your intentional conduct or wrongful use of personal information
failure to take reasonable care in securing your IT systems

Is Cyber Insurance required in Australia?

Cyber Insurance can help you to manage your business's financial risks. While it isn’t mandatory in Australia, it is expected that certain businesses have some level of cover in place – including critical industries, care, finances and utilities. Without insurance, you would be forced to pay out of your own pocket for repair, recovery, and remediation costs from a cyber incident or attack.

What are the main areas covered under Cyber Insurance?

Cyber Insurance typically helps you with expenses spent on five main areas:

Third-party liability
Emergency response and business continuity assistance
Recovery of your data and IT systems
Business interruption due to interference to your systems
Loss to you from crime or fraud.

Does Cyber Insurance cover data loss?

Yes, Cyber Insurance covers your lost information and data, as well as any loss caused to your customers or suppliers if a virus is transferred. It also covers:

notifying potentially affected customers of a data breach
employing computer forensic experts to identify and restore data
repairing damaged computer systems, both hardware and software, to enable the data and systems to operate.

What are the benefits of Cyber Insurance?

Cyber insurance is a specialist insurance policy that provides cover against cyber incidents or attacks that aren’t covered by other insurance policies, such as professional indemnity, management liability, or business packs. This could potentially leave a gap in cover. A Cyber Insurance policy will pay for legal costs, crisis managers, and payment of credits and refunds to customers.

Technology has never been so deeply entwined in our businesses. While it delivers significant efficiencies and convenience, it also comes with significant cyber risks.

SME Business Insurance

Business Insurance is used by many businesses, but it’s best suited to SME-type operators.

SME Business Insurance

What is SME Business Insurance?

Any business in Australia, including small to medium-sized businesses, will benefit from an added layer of financial security in the form of an SME Business Insurance cover. This provides owners and businesses with protection against financial risks and the loss of key assets. It also protects customers, employees, suppliers, and contractors.

Some types of insurance are mandatory, like Workers' Compensation, Professional Indemnity, or CTP Insurance for motor vehicles – these are called statutory insurance covers. Other types of insurance are optional, but they are important ways of reducing business risk and protecting your finances and assets.

What does SME Business Insurance cover?

Property Damage – cover ranges from fire, storm, lightning and other perils to any type of accidental loss or damage. The property insured includes damage to buildings, contents, stock, plant and equipment, raw materials, and consumer goods.
Business Interruption – covers weekly amounts or net profit loss and ongoing fixed costs following property loss or damage. Also referred to as Loss of Profits or Consequential Loss Insurance.
Burglary/Theft - covers break-in at the business premises and the damage is done, as well as theft of goods or stock;
Money - covers theft of money in various locations (during transit, in a locked safe, or in a private residence) at any time (within and outside business hours).
Liability - covers a variety of statutory and civil legal liability, including personal injury and property damage, environmental liability, management liability, statutory liability, professional liability, aviation, marine and motor vehicle-related liability;
General Property - covers specified portable property against accidental loss or damage once it is taken off the premises, within Australia or overseas;
Equipment - covers sudden internal derangement and accidental loss or damage to plant, equipment and machinery, as well as computer and other electronic equipment. Loss of stock and business interruption cover can also be part of this insurance.
Motor vehicle & mobile plant – covers registered and unregistered motor vehicles, mobile plant & equipment, farm equipment, construction plant, as well as attachments and trailers. This insurance can also cover loss of income, downtime and hire costs of replacement equipment.

Speak to an insurance expert

It is our business to understand your objectives, needs, financial situation and risk profile and provide you and your business with tailored risk and insurance advice.
This is how we work with your business:

We analyse your objectives, needs, financial situation and risk profile to develop appropriate strategies and solutions.
With your input, we undertake risk assessments and conduct market research to determine the most suitable insurance product(s) for your key risk exposure.
Your insurance adviser will present appropriate strategies and solutions and also negotiate and place insurance covers agreed.

Frequently Asked Questions

How can insurance help small businesses in Australia?
- In Australia, small businesses are encouraged to invest in business insurance to help protect their business from costly eventualities like damage to property and liability claims. Investing in a comprehensive yet affordable insurance policy promotes the continuity of the business in times of losses or great financial trouble.
What does SME stand for?
Small-to-medium enterprises (SMEs) are businesses whose revenue, number of employees and assets do not exceed a certain threshold. Each country or industry defines a set of criteria to determine whether an organisation falls under the SME category.
How can insurance help small entrepreneurs or SMEs, or how it relates to risk management?
Risk transfer is one of the treatment approaches in managing risks in business, and insurance is an example of risk transfer. It’s a strategy that SMEs employ to shift a risk or a liability from one party to another when that party specialises in managing a specific kind of risk/liability.
Why is insurance important for business owners?
Getting an insurance policy for your business is important, as it cushions or completely shields you from the hefty costs of certain unforeseen issues (accidents, damages to properties, effects of force), legal claims, and other liabilities. Without insurance, business owners might be forced to foot the bill out of their own pocket.

Business Insurance is used by many businesses, but it’s best suited to SME-type operators.

Social Engineering Fraud: What is it and how can you prevent it from affecting your livelihood

April 5, 2019

The continued growth of cyber risk

August 13, 2019