Coronavirus Scams: How to Protect Yourself and Your Business

During difficult times, we often see the most amazing and heroic efforts. People come together to help each other and give freely to help their community.

However, we also see some of the worst moments. The global pandemic has revealed true heroes here in Calgary and around the world, but unfortunately, there has also been a huge number of coronavirus scams. 

Canadians have already been swindled out of $1.2 million from scams related to the coronavirus. We urge you to take precautions to protect yourself, your business, and your employees from these threats.

People are desperate for information and guidance regarding the pandemic, which has made it easier for hackers to trick people into providing personal information and protected business data.

The emails target emotional vulnerability and offer something comforting – a rapid test, a new treatment, or even a way to donate money.

Unfortunately, these emails come from untrusted sources with the simple goal of tricking the recipient into revealing personal information that can be used for identity and password theft, or worse, to infect your network with ransomware and malware.

Norton revealed that an email designed to look like it is coming from the U.S. Centers for Disease Control (CDC) is circulating.

Train your employees not to click on links or open attachments in emails. Never trust an email, even if it seems to come from a reliable source.

Make sure employees on your network (to include remote employees) have the most sophisticated firewall, malware, and antivirus software possible installed and running on their systems.

Review The ITeam Coronavirus IT Guide and The ITeam Coronavirus IT Guide for Small Business

Fake websites are popping up more quickly than ever, and they all have one thing in common: They leverage off the fear and desperation of small business owners, displaced employees, and others to trick them out of personal information.

Whether these websites promise a new vaccine, a quick cure, or a financial offering to help you through this difficult time, the goal is simply to get you to provide information that can be used to steal data. Such websites include scams to obtain your SIN by promising to provide you with the Canadian Emergency Response Benefit (CERB).

Communicate with your employees regularly to make sure they understand how insidious the scams are. Be sure to communicate using a secure environment, such as Microsoft Teams.

Phishing emails are designed to look legitimate. Scammers are taking advantage of the pandemic to try to make easy money by offering people relief payments. Because most governments have legitimate programs in place with these types of programs, an employee’s guard may be down.

When an employee, working in the office or from home, clicks on a link or opens a file in that email, it can trigger a cascade of data encryption.

This starts with the employee’s machine and can swiftly jump into the entire business network. When the file is opened or the link is clicked, a file is downloaded to the computer that rewrites several files and gains administrator access to the computer. To have the files released, a bitcoin payment is often demanded.

Make sure you have endpoint protection, malware detection, and other security on every device you use.

Be cautious about clicking links and opening files that come in emails, even if you are expecting them – and perhaps especially so because of that reason.

Instead of clicking the link to go to the information, type the main URL of the government agency or financial institution directly into your browser and navigate to the information safely.

With more people working from home, personal data is now – more than ever – intertwined with corporate data.

When a person downloads malware into their personal network, it can affect the corporate network.

If you work with confidential files concerning your company, clients, or patients, it is crucial that your devices have the appropriate levels of security to meet PIPEDA and PIPA standards. Dental offices, law firms, accounting firms, oil and gas companies, and medical firms with employees working from home are particularly vulnerable.

Hackers will attempt to gain access to your secure data either to hold it for ransom or to use that data to steal the identities of everyone involved. Either way, your organization could be held responsible for each person’s data lost in the breach. Not only will you potentially face fines, but you will also likely lose customers and tarnish your brand.

Unencrypted communication is one of the biggest risks. Make sure you access the network using a VPN and log out of the company network when you are not working. Use secure phone lines or VoIP. Keep your devices locked with appropriate security at all times when not in use.

The lowest level of security at each employee’s home is the level of security your entire business possesses. Any lack of security posture at home – whether it’s a missing firewall or lack of security on the employee’s personal devices – puts your business at risk.

The typical organization would be protected behind layers of security, including a firewall, multifactor authentication, and threat detection software.

These protections would always be maintained and under the control of your organization’s IT team or managed services provider. That same security must now reach into the homes of your employees.

To remove as much risk as possible, you must take a multi-pronged approach to security.

1. Educate your employees about avoiding ransomware and phishing attacks. Provide ongoing training and communication, provide examples, and ensure they understand the risks to their personal data as well as company data.
2. Establish strict policies about working from home that include having the proper security protocols – full tunnel VPN, endpoint firewall, threat detection, private and public network blocking, URL filtering, EDR protection, multifactor authentication, and more – and provide employees with what they need to operate safely. It should not be at their expense or inconvenience.
3. Have a plan in place, including off-site backup of all data, in case a breach does occur. Be sure to teach employees what to do in case of an attack.