Insight

Bad actors tend to prey during crises because many people aren’t thinking about cybersecurity threats and how to protect themselves and their organizations—they’re too busy with other matters. Distracted by children, pets and spouses, employees working from home may not be thinking about organizational security the way they did in the office. 

But that makes them more vulnerable to phishing and other fraudulent tactics, such as scams to convince unwitting employees to wire money. As the pandemic persists, organizations will continue to face heightened risks—and reap benefits from vigilance.

Don’t Fall for Phishing

Phishing is any fraudulent attempt to gather user intelligence via electronic communication, whether it be email, instant messaging or texting. 

Monex USA has seen an uptick in phishing among its clients since the pandemic began. The goal is often to gain access to email accounts, application user credentials or credit card information. It’s one of the most common ways organizations’ security is compromised. 

Here are telltale signs of phishing attempts. Employees should be trained to recognize these red flags:

• poorly written messages (e.g., bad grammar)
• sender’s email address looks suspicious
• suspicious links in email message
• suspicious attachments
• sense of urgency in message

Beware Imposters

Monex USA has also seen an increase among clients in other kinds of fraudulent attacks, such as bad actors posing as vendors urgently asking for money. The vendor may in fact be familiar, a real organization that you’ve done business with before. But it’s possible that its email system has been hacked and someone is just posing as the vendor to have money wired to the hacker’s bank account.

To mitigate risks related to these kinds of fraudulent tactics, follow these best practices:

• verify claims through a known contact. Call your client or vendor at a phone number you have on file to verify the claim. Don’t just communicate electronically.
• consider using a holding account or escrow if immediate delivery is impossible. (Monex USA’s multi-currency accounts can be used for this purpose at no cost.)
• verify with the manufacturer or the distributor that the seller is legitimate. 
• be skeptical of last-minute changes and invoices sent with sudden urgency
• verify the legitimacy of a sender’s email address—look for transposed or missing letters in domain name, for example (e.g., equfax.com instead of equifax.com)

Stay on Guard With 5 Best Practices

Cybersecurity best practices remain as important as ever as the pandemic continues. Monex USA advises all its clients to adopt:

• two-factor authentication: a software-based authenticator such as Google Authenticator is preferable to the more typical SMS test approach. (Hackers have been known to get mobile network providers to shift phone numbers to a different device after impersonating a target.)
• smart(er) passwords: don’t reuse passwords across accounts and avoid common phrases of any personal significance. Use strong passwords with a mix of alpha numbers and special characters.
• internal checks and balances: never send any wires out without verbal confirmation, especially if banking instructions normally associated with a vendor have changed. 
• when in doubt, don’t click. Never click external email links or attachments unless somebody has told you verbally that they are sending it to you that moment, and then you see it.
• virus protection: ensure your subscription is active and that daily and real-time scanning is turned on. 

Monex USA Online,, our online transaction client platform, employs two-factor authentication and offers user activity alerts. We advise all clients to turn that function on so that anytime a beneficiary is added or edited, or a password is changed, you receive a notification. The platform also locks out users after three failed login attempts, and employs CAPTCHA to block brute force attempts.

Even in the middle of a pandemic that has changed so much of how we used to live and work, it’s essential to avoid becoming complacent about cybersecurity threats. Hackers never do.