Phishing: Impersonating officials and what to do about it

See Part 1 in the Sanitiser Scam here:  and Part 2 here:

Even the World Health Organisation has warned the public about fake emails sent in its name.

The problem with the fake emails is that cybersecurity is not a priority.

According to a 2018 report from cybersecurity leader Varonis, “58% of companies have over 100,000 folders open to everyone, and 41% have over 1,000 sensitive files open to everyone”. This means that if one person in the corporate ecosystem lacks the necessary security and opens a dodgy email or PDF document, they could affect the company’s overall security.

Over the last five years, the principal at Pienaar Consulting, Maria Pienaar, has found that companies have dramatically cut their IT and security budgets, which is a problem as it opens the company to increased cyber and phishing attacks because of more gaps in their security solutions.

She explained that there needed to be more public awareness and education “like what the banks and cellphone networks have done with the scam alerts”.

“Cybersecurity must be a priority from the board level down, with closer collaboration with the business side, finance department and IT,” she explained.

Investigating cybercrime has increasingly become a priority for the police and the Specialised Commercial Crimes Unit of the Hawks, which handles cybercrime and has trained over 3,000 members between 2017 and 2019

In the 2018/19 financial year, the Hawks successfully investigated 104 cyber-related cases out of a total of 130 complaints – almost all of them leading to convictions.

In its annual report, the National Prosecuting Authority noted the successful conviction of an IT specialist, who pleaded guilty to two counts of fraud and was sentenced to 10 years’ imprisonment, three years of which were suspended.

“The accused introduced, or caused to be introduced, or loaded into the company computer system a computer software which had the capacity to allow an unauthorised person to remotely access the company’s user access codes, online bank account portal and users’ online banking passwords,” wrote the NPA.

Then, in October 2016, someone accessed the company’s accounts and stole R703,079.

Although there has been an increase in training received by SAPS officials, Jacqueline Fick, a forensic investigator specialising in electronic fraud, believes that more needs to be done.

According to Fick, the police do not have an accurate figure of the number of cybercrime cases because “victims do not report all these instances to the police”.

“Or,” she said, “where the victim does report the crime, the docket is not opened. For example, a complainant is sent away, with police saying it is a commercial matter.” DM

The amaBhungane Centre for Investigative Journalism, an independent non-profit, produced this story. Like it? Be an amaB Supporter to help us do more. Sign up for our newsletter to get more.