When it comes to cyber security, we’re all vulnerable. Even your small or mid-sized business.

And the number one method used by cyber criminals to infiltrate your network? Phishing.

According to the Canadian Centre for Cyber Security, in 2023 alone, more than 70,000 cyber scams and fraud — including phishing attacks — were reported in Canada. These threats are more common than ever, but would you know how to recognize a phishing scam?

And how can you protect your business from these threats?

Phishing is like fishing. Only, instead of catching fish, cyber criminals are trying to catch your information.

They do this by dangling bait in front of you — like misleading emails, fake websites, phony phone calls, or fraudulent text messages. Their aim is to hook you into handing over sensitive information like credit card numbers, passwords, and/or data.

You know those phone calls you get from scammers, insisting you’ve won an all-inclusive vacation, and to claim your prize they require your credit card number? That’s a phishing attack.

In today’s digital era, phishing attacks have evolved to be more sophisticated. They’ve become so sneaky that an ordinary action like clicking a link or downloading an attachment can be deceiving. Often, these messages are sent from addresses that closely resemble those of trusted organizations or individuals. The scammers rely on human error — like skimming a familiar-looking email address from a trusted source — to get you to engage with their scams.

Once something like the link is activated, the scammers can install ransomware or malware, or steal your data.

• Playbook: Everything you need to know to reduce your risk of a cyber breach
• Internal audit and cyber security: Guidelines and a checklist
• MNP Digital’s Cyber Security & Privacy services

Scammers are innovative when it comes to executing cyber crimes. Even under the umbrella of phishing, scams are becoming more elaborate, and scammers are coming up with more ways to steal your information every day.

In the business world, here are two common phishing attacks and tips on how to respond effectively:

Business email imposters emulate messaging from your organization. This means they reach out to others, disguised as your business, with malicious intent.

By mimicking your business, scammers can gain access to the internal networks of other individuals and organizations — like your clients or your suppliers. This kind of hoax reflects poorly on your business and could have a major impact on your reputation and sales.

Being proactive will protect your customer’s assets, as well as manage your reputation. If scammers are spoofing your business, you need to act quickly:

These scams are executed by cyber criminals impersonating a tech support team. The threat actors often pretend to be from a large, recognizable organization, contacting you most commonly via phone calls, pop-ups, or emails.

These scammers declare they’ve found a technical issue or security threat with your computer. Then, they’ll ask you take action. Here are some of their tactics:

• Request remote access to your computer
• Ask you to install software
• Try to sell you software or IT services
• Try to sell you a warranty program
• Direct you to a fake website
• Request your credit card information for fake services

Organizations of various sizes have fallen victim to tech support phishing scam. It’s important to back up data, have updated software and hardware, and a plan to minimize any damage caused by this hoax. Here are some steps to take if you feel like you’ve fallen for a tech support scam:

Protecting your small or mid-sized business against phishing attacks doesn’t have to be a daunting task. Here’s how you can stop phishing in its tracks:

When it comes to unsolicited emails or messages, remind your team to think twice before clicking links or downloading attachments from unknown senders. Encourage research to ensure person or company who reached out to you is legitimate. And have a keen eye: some scammers are getting very good at impersonating real people and organizations. Look closely for spelling and grammatical errors.

There may be times when you do your research on the sender, but still feel unsure. Don’t assume your business is safe. Reach out to a team member or an IT resource before taking any action on the threat. Bringing in an IT expert or some fresh eyes may be able to identify any red flags or already be aware of common phishing scams.

Installing passwords on all devices is only the first step your organization can take in securing files, devices, and wireless network. Protect your business further by setting up multi-factor authentication, backing up your files, setting your infrastructure to update automatically, changing the default settings on your router, and encrypting your devices, router and storage.

Avoid major disruptions by implementing a breach plan. This plan focuses on saving data, reaching out to your clients and partners, and ensures your business can keep running without a hitch.

It never hurts to call another person at the company in question. While they may not be the sender, they should be able to confirm the legitimacy of the request. If they claim to be your credit card company, for instance, hang up and call back. However, do not use the contact information provided by the suspicious source.

Through ongoing training and empowerment, you can encourage your employees to spot and report any phishing scams or suspicious activities.

By staying informed and vigilant, you can reduce the risk of phishing attacks and protect the sensitive information of your business.

Phishing attacks can be expensive to recover from.

To minimize the cost associated with a breach, you may want to consider cyber insurance for your business. This insurance can cover you in the event of data breaches, general cyber attacks, attacks on hosted data, and terrorist attacks.

Here are some other factors to consider if you’re thinking of investing in insurance coverage:

• Will you be protected in the event of a lawsuit?
• Do they provide any additional coverage?
• Do they provide an emergency number for immediate assistance in the event of a breach.

Make cyber security a cornerstone within your organization and meet phishing attacks head on. By prioritizing the protection of your devices and IT infrastructure, you can build a culture of security, prevent costly phishing attacks, and maintain your business’s reputation.