Your Greatest Weapon Against Cyber Criminals: A Zero-Trust Mindset

Trust makes the world go round and is a cornerstone of healthy relationships. So you might be surprised to learn that as a community bank built on a foundation of strong relationships, we’re coming to you with a seemingly counterintuitive message:

Trust no one.

Of course, we’re specifically talking about applying a zero-trust approach only to your technology communications – your email, phone calls, and text messaging. Because cyber criminals are always lurking — potentially in your inbox, sometimes on the other end of a call, and even behind a normal(ish)-looking text message.

Cyber criminals spend their days trying to exploit your trusting nature by attempting to look and act just like you do. They do this to trick you into taking actions to share information, provide access to systems, or conduct fraudulent financial transactions.

This is where the no-trust policy comes into play. Because if you approach technology requests assuming the worst (but secretly hoping for the best), your vigilance will be rewarded.

Below, find some of the most common tactics employed by cyber criminals, as well as examples of what these tactics might actually look like. We then follow these tactics with helpful advice on how to respond to suspicious requests — besides just giving them all the skeptical side-eye, which is also warranted.

Deceptive Tactics Employed by the Common (Cyber) Criminal 

The nature of cybercrime means that it’s constantly evolving. But a few scams that routinely make their way into inboxes near you include:

• Phishing – This is the most common method used by criminals to pose as a trusted source (friend, colleague, boss, service provider, etc.) and present some plausible scenario to get you to verbally hand over or type in your logon credentials or other sensitive data. (Need more info? We’ve written about phishing on our blog before: Don’t Take the Bait When It Comes to Phishing Scams.)

What does it look like? This usually comes as an email that appears to be from a valid business (PayPal is a common target) saying your account has been deactivated and asking you to “verify” your credit card details — by entering them.

• Pretexting – This method uses some kind of story or pretext to gain your trust. Again, the goal is to get logon credentials or credit card info from you.

What does it look like? Often the pretexter will present what seems like a plausible scenario, like a message or call from someone in tech support or senior management. This might be something like: “Hey, I’m sure you have seen that security issue in the news. I’m from Microsoft support and your computer has the same issue so I’m calling to get that fixed.”

• Email Account Compromise – This is a type of pretexting where a cybercriminal gains access to your email and uses information collected in that email account to send requests to your bank to authorize financial transactions or make account changes.

What does it look like? The pretexter will look through prior email messages to seek out account numbers and other information about the financial institutions you bank with regularly. They may learn enough about you to attempt to make fraudulent transactions on your behalf while appearing to be you.  

• Baiting – This is a type of social engineering where the criminal will try to entice you to click on a link or download something. The bait could be anything — there are literally thousands of examples, such as promises for rewards, bonuses, discounts, or even social connections, etc.  

What does it look like? Maybe it’s an email from a legitimate friend (using a fake email address) saying, “You’ll never believe who’s in this picture!” When you click the link to the “picture,” you’re giving the baiter access to your system through malware or a virus. 

Now that you know the basics: Are you ready for more information on tactics? The Federal Trade Commission has a robust consumer resource on phishing.

How to Fight the Good Fight Against Cybercrime

Here are some tips for adopting a zero-trust mindset to successfully gain the upper hand against your cyber enemies:

• Slow down or take a pause. Be wary of any unsolicited messages that give a call to action. The criminals want you to move fast and not think. They want you to follow their requests for you to do something before you reconsider. High-pressure tactics are very common. “You must confirm your credit card right away to protect your account” (when in reality, your account is just fine, and “confirming your credit card” just gives bad actors your credit card number).
• Verify. Is the person who sent this really who they say they are? Don’t blindly trust display names, emails, or phone numbers. If you know them and they sent an email, pick up the phone and call (or vice versa).
• Do NOT trust attachments. If someone emails you an attachment or link unexpectedly, call them to confirm that they sent it.
• Use your own links. Open a new browser window and visit the destination on your own. If you get the “Your PayPal has been compromised” email, for example, go to PayPal (without clicking the link in the email), and do your own poking around in your profile/account. Cybercriminals have abundant time and resources to make a fairly convincing replica of a bank or business email template, so the best way to confirm independently is to avoid the emailed materials, start fresh with a new browser window, and explore for yourself.
• Don’t download. While you may have to download apps or docs on occasion, in most instances, an unsolicited request for you to download something is probably an attempt to gain access to your computer.
• Ignore and delete. Requests for personal information, logon credentials, passwords, and account numbers are scams. Promptly delete them. Do not respond. No business will EVER email or text you asking for your logon information.
• Don’t be helpful. Watch out for requests for help that look or feel something like this: “I’m really in a bind and need your help getting xyz done, and it needs to be done right away.”  Delete the message.
• Use two factors and monitor your account activity. It should be your policy to always use more than one factor to verify the authenticity of any significant change or request. Monitor your accounts regularly and be on the lookout for suspicious activity. (Be sure to check out this Plumas Bank resource for more insight: Enabling Multi-Factor Authentication — Extra Steps, BIG Safety ROI.) 

Now that you know some tactics and have tips at your disposal, keep in mind: If you feel like you may have fallen victim to a phishing scheme, do not feel embarrassed. Seek help from a computer support professional and notify your regular contacts and financial institutions. Change your passwords immediately.

For business owners and managers looking for more insights into how to protect your business, try this from our blog: Cybersecurity 101: Tips For Small Business.

Or use the button below to browse our cybersecurity articles.

Access Our Cybersecurity Resources