CYBERCRIMINALS SEND OUT a staggering number of phishing emails to businesses every year. Through these fraudulent messages that appear to be from a reputable source, scammers try to trick employees into revealing proprietary and confidential data or taking an action that will benefit the criminals — and harm your business. Cybercriminals often use a tactic called spoofing — impersonating a legitimate business or person — in an attempt to fool employees into clicking a link, opening an attachment, changing account information or conducting a financial transaction. When these phishing attempts use SMS or messaging apps, they are often called smishing.
Clicking those links or opening those attachments can automatically install malware. Depending on the type of malware, this could give the criminals access to your computer or device, install ransomware (in which malware infiltrates your system and cybercriminals hold your business hostage until a fee is paid), and even allow them to burrow further into your company's servers or cloud storage. Let them in, and they could steal your company’s confidential information and damage the reputation you’ve worked hard to build with customers.
When the fraudulent communication occurs in a workplace setting via an email that appears to come from a colleague, client, vendor or other trusted source, it’s known as business email compromise (BEC). While the impact of BEC can seem overwhelming, there are things you can consider doing to help protect your business, your customers and your employees from email scams. Consider these best practices:
- Avoid clicking on links or attachments from untrusted sources.
- Educate employees to identify and report emails, messaging and phone calls that may be fraudulent.
- Use confirmed contact information from within the company’s internal contact management system when verifying requests to change information or transfer funds.
- Require multiple-person approvals for account and financial change requests.
- Encourage employees to ask questions and challenge suspicious activity before acting on requests.
For tips on what to do if you think your business has experienced a cybersecurity event, download “Cyber security checklist: Consider taking these steps if your business has been targeted,” and share it with your employees.
Stay connected, stay protected
To help keep your Merrill account information safe and secure, make sure your contact information is up to date, and set up security and account alerts so we can stay in touch. Remember, if we need to reach out to you, we’ll never ask for personal or financial information or an access code through email, text or unsolicited calls. Visit our Security Center for tips on how to recognize potential scams, and learn more about how to keep your accounts safe.
Neither Bank of America nor its affiliates provide information security or information technology (IT) consulting services. This material is provided “as is,” with no guarantee of completeness, accuracy, timeliness or of the results obtained from the use of this material, and without warranty of any kind, express or implied, including but not limited to warranties of performance, quality and fitness for a particular purpose. This material should be regarded as general information on information security and IT considerations and is not intended to provide specific information security or IT advice, nor is it any substitute for your own independent investigations. If you have questions regarding your particular IT system or information security concerns, please contact your IT or information security advisor.
