The ‘Suspicious Email Reporting Service’ has now received more than 1 million reports of scam emails, the UK National Cyber Security Centre (NCSC) has just announced.
It has been determined that fake cryptocurrency investment offers actually account for over half of all online scams detected through public reporting, the National Cyber Security Centre has now confirmed.
The 1 million figure was reached in just 2 months with the ‘explosion’ of cryptocurrency investment scams amongst a range of online threats, which have been blocked.
Cryptocurrency
More than half of the 10,000 online links to scams blocked or taken down by the National Cyber Security Centre (NCSC) are for cryptocurrency schemes, where investors are promised high returns in exchange for buying blockchain currency such as Bitcoin.
Phillip Hay, Head of Threat Intelligence Analysis at Mimecast stated that email remains a “key vector” for cyber-criminals so it is unsurprising to see so many phishing emails reported to the NCSC.
Report
Hay commented “At Mimecast, our recent State of Email Security report found that 60% of organisations believe it’s inevitable or likely they will suffer from an email-borne attack in the coming year.
The same study found that 72% said phishing attacks remained flat or increased in the last 12 months.
Exacerbated
This is also exacerbated by the coronavirus pandemic, which has led to a real uptick in email-borne attacks. Our research found that detections were up a third during the 1st 100 days of the pandemic.”
Hay added that security leaders need to invest in a strategy that helps builds resilience moving at the same pace as digital transformation.
He commented further, “This means organisations must apply a layered approach to email security, one that consists of attack prevention, security awareness training, roaming web security tied to email efficacy, brand exploitation protection, threat remediation & business continuity.”
Cyber Aware
The scheme was launched in April as part of the Government’s Cyber Aware campaign, getting a daily average of 16,500 emails.
While cryptocurrency scams are the main scams detected, there have been cases of fake online shops & spoofs involving brands such as TV Licensing, HMRC, Gov.uk & the DVLA.
Figures reveal that 10% of the scams were removed within 1 hour of an email being reported, & 40% were taken down within a day of a report.
Malicious
10,200 malicious URLs linked to 3,485 web sites have been!
This service was developed with the City of London Police & will also support UK policing with a live time analysis of reports & identifying new patterns in online offending.
Commander Karen Baxter, City of London Police, observed “Unquestionably, a vast number of frauds will have been prevented, thanks to the public reporting all these phishing attempts.
Not only that, but it has allowed for vital intelligence to be collected by police & demonstrates the power of working together when it comes to stopping fraudsters in their tracks.”
Stark Reminder
Paul McEvatt, Senior Threat & Intelligence Manager, Fujitsu EMEIA said the million mark was a “stark reminder” that even in a time of global crisis cyber-criminals have ramped up their attempts to exploit their victim’s anxieties.
“Phishing attacks are one of the most effective methods of attack for cybercriminals & affect every institution and industry.
There are increasing reports of cyber-criminals using phishing emails to collect data from organisations in order to create fake websites & profiles; the attackers may then use those profiles to claim support under government aid schemes that have been set up to help during the crisis.
Masquerading
McEvatt said that it is not just businesses & organisations that are affected, with ‘ordinary people’ arguably at the greatest risk.
He added, “Masquerading as Coronavirus updates, information around the availability of masks & vaccine information – even posing as organisations looking for donations to charitable relief funds – are hard to spot but becoming increasingly common.
Irregularities
Irregularities in emails, such as an unexpected emphasis on urgency, spelling & grammar mistakes & whether they expect an email from the sender are all signs that the email is a phishing attack.”
Matt Lock, Technical Director UK at Varonis explained further that it was “pleasantly surprising” to see a positive report about the public stepping up & reporting email scams & threats. Lock explained “It would be easier for individuals to simply delete suspicious emails, but it’s reassuring to learn that many are taking the extra step to report with some brilliant results.
Scammers
“Mobilising the public at large to remain watchful and report unusual activity is not fool proof – scammers are a moving target because they can easily change their tactics. The ‘Suspicious Email Reporting Service’ is an approach that makes sense while offering reminders to individuals to stay alert.”
Ed Macnair, CEO of Censornet, added that though it is good to see people being vigilant against spam & phishing attacks, these figures from the NCSC demonstrate the extent of the problem. Cyber-criminals will continue to capitalise on the hysteria surrounding Covid-19 to exploit both organisations & individuals, preying on their curiosity & vulnerability.
Social Engineering
Despite the success of this Suspicious Email Reporting Service, there are still social engineering attacks that will continue to slip through the net due to human error.
“It is crucial that organisations take it upon themselves to protect employees from these email attacks in the first instance. Businesses need to use email security that combines algorithmic analysis, threat intelligence & executive name checking to efficiently protect themselves against these evolving attacks,” concluded Macnair.
https://www.cybernewsgroup.co.uk/virtual-conferences/
