Training employees on the dangers of online scams

02/13/09

Keeping your business safe from online dangers is an on-going task that is critical to your success. Even when you think you’ve taken every precaution imaginable, the threat of attack is still there.

Through a combination of network security measures and employee training, many organizations are succeeding in the fight against dangerous online predators. Those businesses understand that their employees are the first line of defense against such threats.

One of the most prevalent online scams is called phishing. Phishing is the term used for the fraudulent process criminals use to acquire sensitive information such as usernames, passwords and credit card information by posing as a trustworthy contact.

Phishing scams are most commonly used in emails and instant messages, and messages often direct recipients to visit a fake website. Thinking that the website is legitimate, the message recipient then enters all of their personal information, placing it directly into the hands of thieves.

To train their employees on the dangers of phishing scams, the U.S. Department of Justice (DOJ) put together an interesting test. The DOJ designed an email that resembled common phishing scams and sent it out to their employees without warning.

The Department’s email was written in regards to the Thrift Savings Plan (TSP), a retirement savings plan that many civilians employed by the U.S. government and uniformed service members use. Like many other financial institutions, the savings plan had recently fallen victim to the economic recession.

The message in the email instructed users to visit a site where they needed to enter their account information by the end of the month. The message mirrored the information in common online scams and the site was fake.

Some employees spotted the scam right off the bat, other employees were warned by coworkers, but it created enough of a commotion that the real TSP site put a warning message on their home page.

After about a week of this going on, the assistant director for information systems security at the DOJ sent the worried employees a memo explaining the hoax and that the email was simply a test. A test that the employees passed with flying colors.

Training employees on the dangers of online scams should be part of every company’s online security program. Phishing scams prey on our human nature to respond to things that we think are important to us, making everyone and every business vulnerable.

If successful, a phishing scam could seriously damage your bottom line by incurring financial loss, customer data breaches and intellectual property theft. Making user awareness training a part of your corporate security program will help mitigate the risk.

Help your employees avoid online scams at work and at home with this advice:

• If you receive an email asking for personal or financial information, do not reply or click on any links.
• Don’t call any phone numbers included in the email. Some scams require recipients to call a phone number to update account information.
• Install anti-virus and anti-spyware software, along with firewall protection. Make sure your virus definitions are updated regularly to protect against the latest threats.
• Never email personal or financial information.
• Keep a close eye on your credit card and bank statements for any strange activity.
• At the first sign of an online scam, call HR or whoever is responsible for your organization’s online security and report the threat.