Online Security The Email Edge: The New Cyber Crime

An email pops up in your inbox, saying you have a date in court. And it uses your first name. Pretty alarming, no? Not to worry — courts don’t communicate that way. It’s a scam — a variant of one that apparently has spread from Australia and the UK. But the purpose isn’t to bilk you out of money — it’s to steal your identity and get you to click on malicious links.

Welcome to the new spam, a phenomenon that threatens consumers and companies alike. Such schemes have long existed, but they are now more insidious, thanks to improved technology and the boundless creativity of the perpetrators.  

For example, the Internal Revenue Service warned this week that thousands of taxpayers’ W-2 records have been compromised. 

“This particular scam, sometimes referred to as business email spoofing (BES), reportedly first appeared last year, said the IRS,” PYMNTS.com reports. “Cybercriminals send emails to employees in payroll and human resources (HR) using slightly modified email addresses to make it appear as if the emails are coming from an organization executive, said the IRS. The email requests a list of all employees and their W-2 forms.”

PYMNTS.com continues that the scam has “evolved beyond affecting just the corporate world and has spread to other sectors, including school districts, the health care sector, temp agencies and nonprofits, among others.”

It used to be that fraud artists rented an email sucker’s list: Many still do. But it’s expensive, and not as reliable as it once was. Anyway, why risk the liability to both sender and vendor? There are better ways.

Take the “snowshoe spamming” allegedly conducted by Michael A. Persaud. Persaud was indicted on federal charges this week, according to Krebs on Security.

“The Justice Department says Persaud sent well over a million spam emails to recipients in the United States and abroad,” Krebs on Security writes. “Prosecutors charge that Persaud often used false names to register the domains, and he created fraudulent “From:” address fields to conceal that he was the true sender of the emails. The government also accuses Persaud of “illegally transferring and selling millions of email addresses for the purpose of transmitting spam.”

It gets worse.ZDNet reported yesterday that spammers can spoof Gmail accounts, and that Gmail can’t stop them. Renato Marinho, a researcher from Brazilian security firm Morphus Labs, claims that Gmail “doesn't filter or indeed even warn users about dodgy messages from a spoofed @gmail.com address,” according to ZDNet. “That is, the email appears to have come from a Gmail account, but actually came from a non-Gmail server. It's not hard to imagine the fun that hackers and spammers could have with this behavior.”

 The solution? Stronger cyber security at companies and institutions of all kinds — to protect customers, employees, and everyone.