Problems Can Come from Places You Don't Expect

Protecting Your Work and the Connections That Matter — Part 4

An email from a business partner you know well

One day, you receive an email from a company you have worked with for a long time.

It is about an invoice.

You communicate with this company regularly, and the email signature looks familiar. There is nothing unusual about the attached document, either.

But one detail catches your attention:

“Our bank account details have changed. Please use the new account for this payment.”

You assume the message is from your business partner and transfer the money to the new account shown in the document. Later, however, the company contacts you and says, “We have not received your payment.”

The email was not actually sent by your business partner. An attacker had gained unauthorized access to the partner’s email account and used it to send fraudulent payment instructions.

This is a simplified scenario based on attack methods that have been reported in real cases. Japan’s Information-technology Promotion Agency (IPA), a public organization that provides cybersecurity guidance, has published examples of attackers impersonating business contacts or taking over their email accounts to request changes to bank account details.

In other words, an email can look genuine for a reason beyond a convincing name or writing style. A fraudulent message can even come from an email address that really belongs to the person or company you know.

Trust can make these messages harder to recognize

We rely on many people and businesses to do our work.

Invoices from familiar suppliers. Messages from long-standing business partners. Notifications from services we use.

We could not do business if we questioned every single message.

That is why, in everyday communication, we often feel comfortable relying on a sender’s name or email address and on a familiar format.

But that trust can be abused.

For example:

• A business partner suddenly asks you to use a different bank account.
• A service you regularly use sends an unexpected email asking you to log in.
• Someone you know sends an unfamiliar file or link.
• Someone claiming to be a manager or business owner tells you to act urgently.

Not all such messages are fake. Some may be genuine and require action.

The important point is that a message appearing to come from someone you know does not necessarily mean that the message itself is legitimate.

What if a Wi-Fi network has the same name as the real one?

This does not apply only to email.

Imagine connecting to Wi-Fi at a café or hotel while you are away from work.

The venue’s sign says that its Wi-Fi network is called “Cafe-Guest.” You see a network with the same name on your smartphone, so you connect to it.

But what if the network is not provided by the café? What if someone nearby has set up a fake access point ?

The name of a Wi-Fi network is chosen by the person who sets it up. That means someone can create a fake network using the same name as a real one.

This technique is known as an Evil Twin attack. Public cybersecurity guidance from the Tokyo Metropolitan Government in Japan has also warned about fake access points using the same Wi-Fi name as a legitimate network, as well as the risk of devices connecting to them automatically.

Connecting to a fake Wi-Fi network does not necessarily mean that all of your communications will be exposed. However, it may lead you to a fake login page where you are tricked into entering your username and password, for example.

A network name that looks familiar is not, by itself, proof that the network is genuine.

A problem does not have to start inside your own business

The examples above have something in common.

In the email example, the attacker abused a business partner’s email account. In the Wi-Fi example, someone created a connection that looked like one the user already trusted.

Neither situation began with someone directly breaking into the computer at your own business.

 A familiar business partner | v Email arrives | +-------+-------+ | | v v Genuine email Fraudulent email | | v v Normal action Incorrect payment | v Loss occurs 

 A familiar venue | v Connect to Wi-Fi | +-------+-------+ | | v v Legitimate Wi-Fi Fake Wi-Fi | | v v Normal browsing Redirect to a fraudulent page 

The things we use every day and the relationships we trust can become unexpected points of entry.

Attackers do not always need to target your computer or shop directly. They may create a point of contact through a business partner or an external service and use it to obtain information or money.

As we saw in Part 2, our work is connected to many people and services. Those connections make work easier, but a problem somewhere along the way may affect our own business, too.

You do not need to suspect everything

After reading this, you might feel that you should question every email from a business partner and every Wi-Fi network you use away from the office.

You do not need to do that.

To keep doing business, we need to trust people and make use of convenient services. What matters is pausing to check when something is different from what you normally expect.

For example:

In particular, do not rely on an email alone when someone asks you to change bank account or payment details. Confirm the request using a phone number or another contact method you already know to be genuine.

This does not mean that you distrust the other person. It is a way to protect both businesses and the trust between them.

The entrance may be closer than you think

When people hear “cyberattack,” they may imagine highly skilled attackers breaking into systems from somewhere far away.

But in reality, everyday things such as email, Wi-Fi, and communication with business partners can also be abused.

That does not mean you should stop using convenient tools or cut off the connections your business needs.

It means taking a moment now and then to check who or what is on the other side of those connections.

Do not rely only on the feeling that “this is the person I always deal with” or “this is the place I always use.” When something is different from usual, take a moment to check.

That is enough for a first step.

In the next article, we will look at what you can do about the risks we have discussed. You do not need to protect everything perfectly. We will consider small, practical steps that fit your own business.