Cyber Insights with Mercury IT- February 2025

Understanding Business Email Compromise (BEC) Business Email Compromise (BEC) is a growing threat to companies of all sizes. One common tactic involves manipulating invoices, which can lead to significant financial losses. Here's how it typically works:

1. A criminal hacks into your supplier's email account.
2. They send you an invoice that looks legitimate but with altered bank details.
3. If you pay without verifying, the money goes to the criminal instead of your supplier.

The Tricky Part The email comes from your actual supplier's address, making it hard to spot the fraud. The only suspicious element is the change in bank account details. A Real-World Example Our Chief Information Security Officer, Chris Haigh recently shared a post on LinkedIn about this issue, read full post here Legal Implications A recent court case ruled that the invoice recipient has a duty to verify the authenticity of invoices and their details. This means your business could be held responsible, even if it wasn't your email that was hacked. Protecting Your Business To safeguard against BEC and invoice fraud, consider these steps:

1. Implement a verification process for any changes to bank account details, such as a phone call to confirm.
2. Train your staff on the importance of following this process without exception.
3. Consider cyber insurance as an additional layer of protection against cybersecurity attacks.

By following these guidelines, you can significantly reduce your risk of being a victim of BEC and other cyber threats.

Staying Safe Around Always-Listening Devices With the overwhelming popularity of always-listening devices such as Alexa, Google Home, and smartphones, you’ve probably heard stories of these devices joining in on conversations without being prompted. Perhaps it’s even happened to you! While this idea can be alarming and unsettling, there are ways to protect your private information, and conversations, from these always-listening devices. To help you stay safe from these devices, here are some tips:

• Review and delete voice recordings: Your device will store your search and activity history to create a customised experience for you. However, you can review and delete these recordings from the device of your choice in order to protect your privacy.
• Mute the microphone: You can mute your microphone to ensure that your device is not listening and recording when you are not using it. The recording capabilities will remain off until you turn them back on.
• Don’t link accounts with sensitive information to your device: If you have any accounts containing your sensitive information in them, it is best not to link those accounts to your device. This will keep your sensitive information secure from potential data breaches.
• Change the settings to automatically manage data stored by the device: Personally, managing what data is linked with your account will give you more control over the information stored by your device and will save you time when deleting your history.
• Turn off your device when you’re away: When in doubt, turn it off. If your device does not have a power button, simply unplug it.

By making a habit of unplugging and deleting voice recordings from these always-listening devices, you can help ensure that there is an extra layer of protection between them and your private information.