We are hearing from members that their emails are increasingly being hijacked. Cybercriminals have reached a level of sophistication that surprises many people. They have been able to insert themselves into transactions midstream. It can work like this: A dealer offers to buy out a customer’s lease from a lessor. They have an established relationship with the lessor and communicate through email. The lessor gave the buyout amount and asked for payment by cheque. Later, the dealer received another email, appearing to come from the lessor, stating that they now would only accept payment via Electronic Funds Transfer (EFT) and attached the form. The dealer proceeded with payment by EFT. Days later, the lessor called asking where their cheque was. The EFT had gone to criminals and not the lessor. Practice Good Cyber Hygiene Train your staff to avoid clicking on unsafe attachments, how to recognize spam emails, and when unsure, to ask. Don’t give crooks access to your systems in the first place: - All payments should require dual authorization
- Any changes to payment methods should be confirmed by phone or in person
- Changes to payment methods should be considered suspect, especially mid-transaction
Don’t Assume Anything – Be Suspicious - Bad guys can intercept emails
- Bad guys can spoof emails with requests to send EFT and so on
- These cons can be from outside or inside a dealership
Confirm before you pay | 