According to a new survey, social media sharing – and oversharing – provides cybercriminals with important personal details to commit identity theft, fraud, and more.
Nearly everyone today uses social media to post the latest on their lives – what they’re doing, where they’re at, who they’re with, and more. And, in the context in which it’s intended – to let known followers/friends/family keep up-to-date with your latest mood/trip/efforts/etc. – it’s relatively harmless.
But in the case of those who don’t put security controls in place, or are leveraging social media platforms that don’t have much by way of security, the general public can view the posts. This opening allows cybercriminals to gather critical details than can be used as part of a scam.
According to a recent survey by UK-based online safety organization Get Safe Online, nearly half of online users (46%) have been a victim of one or more forms of fraudulent behavior on social media.
And it’s no wonder. All scammers need are a few key details to establish enough context that will convince someone they are you, along with a spoofed email address, and the game is on!
Take the example of a CFO that posts about going on vacation to a remote part of the world. Using key details from posts on social media, along with a bit of digging to identify the proper target within the organization, and a scammer can send a convincing “I lost my phone and had to resort to using my gmail account” message asking a member of the finance team to pay an incoming invoice (which is part of the scam).
While not every user is a CFO, cybercriminals are looking for an easy way to convince someone to part with their money, so it’s important that users realize anyone can be a victim – of either the identity theft or a scam leveraging someone’s identity.
So, what should you do to help minimize the risk of these kinds of scams?
- Review social media security – if possible, restrict the scope to which posts are seen to just friends.
- Consider the platform before posting – posts on platforms like Twitter are generally thought of as publicly seen.
- Minimize granting permissions to your profile – sites asking to access your profile for any reason are bad news; they may just be wanting access to your email address and friends list, looking to use that data to commit their scam.
- Educate users on this kind of scam – the use of Security Awareness Training informs corporate users of scam tactics like these, as well as best practices to proactively protect their online presence, as well as reactively respond to potential attacks should they become the target of a fraud attack.
Users can no longer consider their personal activity online as being separate from their corporate responsibility – with cybercriminals realizing the value of the two together, organizations need to take steps to ensure users are protecting themselves and the organization, when online for any reason.
Here's how the Social Media Phishing Test works:
