Governments are prime targets for phishing & CEO fraud
Multi-channel scams increasingly common
Dutch daily newspaper Trouw recently reported an incident involving Alkmaar City Council. A cybercriminal posing as a council executive had managed to trick a staff member into making an urgent €236,000 funds transfer. Not noticing that the supposed executive's e-mail address was based on a 'typo-domain', the council worker simply did as his 'boss' told him. Thus adding the City of Alkmaar to the growing list of local authorities defrauded by internet scammers. Despite the warning provided by multiple attempted frauds earlier in the year.
Governments targeted more often in 2023
From the results of Alert Online's annual cybersecurity survey, we know that the Alkmaar incident is far from unusual. Local government workers who took part in the survey reported that attempted CEO frauds and phishing are increasingly common. And scams often involve not only e-mail, but also WhatsApp and voice calls to make them more convincing. All of which begs the question: are governments sufficiently well prepared? Especially with frauds becoming more sophisticated all the time. The crooks behind the Alkmaar incident knew exactly who to contact about their invoice, for example.
Part of a global trend
Problems are by no means confined to the Netherlands.In its annual phishing survey published last month, Cloudflare reported that the incidences of phishing and CEO fraud are rising, and that it's increasingly common for multiple channels to be used. So, for example, the same person within an organisation will get both an e-mail and a text message ('smishing'). In addition, scammers will often set up a 'clean' website to win the confidence of a victim and their firewalls, then add their malicious code later. And, if they don't succeed at first, they'll keep on trying. Another point highlighted by Cloudflare is that lookalike domain names are often an important feature of the scams -- a trend reflected in the growing demand for brand monitoring.
Non-reporting of incidents is a big problem
Against that backdrop, it's regrettable that many attempted scams are never reported, either internally or externally. According to Alert Online's findings, 40 per cent of government workers didn't report attempted scams. Typically because the incidents came to nothing, or because the individuals involved didn't see reporting as their responsibility. However, if incidents aren't reported, the scammers have free rein to go on trying, just as they did in the Alkmaar case.
Perceptions don't match reality
It appears that a exists discrepancy between perception and reality within many government organisations. Personnel working for such organisations say that their awareness of cybersecurity is reasonably good: they give themselves an average of 6.8 out of 10 on that score. Yet the growth in attempted scams and reported incidents suggests that crooks see governments as attractive targets. A quarter of surveyed government workers say that they have received phishing mail in the last 12 months. Yet survey respondents consistently report that government bodies' internal communication on the subject leaves a lot to be desired and doesn't command readers' attention.
About Alert Online
October is European Cybersecurity Month, and in the Netherlands Alert Online and its partners, including SIDN, are organising all sorts of cybersecurity-related activities. Visit the Alert Online website for details. Alert Online's full cybersecurity survey report is available to read at the government website