Many organisations think an attack starts with a weak spot in software. In practice, technology is rarely the real problem. Most attacks succeed because someone makes a wrong decision, and that can happen to anyone. The case study in The Digital Compass shows how.
The example: Jansen & Co
It was an ordinary Monday morning at Jansen & Co, a mid-sized trading company in building materials. Employees checked their email, processed orders and helped customers. Nobody noticed that a criminal was breaking in at that very moment.
Phase 1: the initial infiltration
An attacker had obtained a list of employee email addresses. He sent a convincing phishing email to Karen in accounts. It seemed to come from a trusted supplier and contained a link to a supposedly important document. Karen clicked, entered her login details on the fake website, and gave the attacker access to her business mailbox.
Phase 2: exploring unnoticed
With access to the mailbox, the attacker patiently looked around. He read conversations, studied invoices and gathered information about suppliers and customers. This phase can take weeks to months. All that time, the attacker often goes unnoticed.
Phase 3: manipulating invoices
The attacker saw that Jansen & Co regularly received payments from customers. Posing as Karen, he emailed several customers asking them to make future payments to a new account number, supposedly for administrative reasons. To make it convincing, he attached copies of real outstanding invoices. This is called invoice fraud.
Phase 4: discovery and damage
A few weeks later, customers called to confirm the new account number. That raised suspicion. An internal investigation showed that several payments had gone to the attacker’s account. The damage ran into tens of thousands of euros.
Why it went wrong
Criminals do not target one weak spot, but a combination of bad habits. A reused password, an unprotected mailbox and no two-step verification together are an open door.
Not just by email
Phishing comes in many forms. The Digital Compass names three that happen every day:
- The fake bank: an email with an urgent warning about suspicious activity on your account, with a link to secure it. Everything looks familiar, but you send your login details to criminals.
- The fake helpdesk: someone calls on behalf of “IT support” and asks you to confirm your password. The voice sounds professional and helpful.
- CEO fraud: the ‘director’ sends a WhatsApp message: “I am in a meeting and cannot call, but we need to make an urgent payment. Can you handle this?” Time pressure and authority do the rest.
Criminals play on stress, time pressure and routine. That is why awareness matters as much as technology.
How to prevent it
- Two-step verification on all important accounts. A stolen password then does not give direct access to your mailbox.
- Unique passwords in a password manager. A leaked password then does not work anywhere else. Read more in A password policy that actually works.
- SPF, DKIM and DMARC on your domain. Then criminals cannot simply send email as if they were you. How to set this up step by step, you can read in From none to reject. The free domain check shows you right away how your domain is doing.
- A fixed agreement on payments. Always check changes to account numbers and urgent payments through another channel, for example by calling a known number.
- Train employees continuously. Not only on phishing, but also on CEO fraud and invoice fraud. And make sure everyone dares to report a suspicious situation without fear of punishment.
More in The Digital Compass
This case study comes from the first edition of The Digital Compass (in Dutch). It also covers what cybercriminals really want, how ransomware works and which five actions pay off most.
