The ASOS hack started with a fake ‘trusted contact’. Would you spot one?
Part 3 of 5 in our October series: small, free steps to take control of your own cyber security.
Most of us like to think that we could spot, and avoid, a scam email or text. We’ve all seen the emails from a prince with a fortune to share, and the texts about a parcel we never ordered. The red flags are obvious, and we delete them without a second thought.
But some scams are much harder to spot. Perhaps it’s just a very ordinary-looking request from a colleague asking for the password to the shop admin area, or your web developer asking you to send them the two-factor code you’ve just received by email. Perfectly reasonable requests on the surface – would you be able to tell which are genuine?
What happened at ASOS
If you’ve seen the news in the last week, you’ll know that on 6th October, ASOS app users received a push notification from the company’s own app claiming that it had been hacked.
While the investigation into the full extent of the impact is ongoing, we now know how the hackers gained access. ASOS explained that “an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials”. Those credentials were then used to access information on third-party platforms used by ASOS. This type of hacking – when someone pretends to be a person or organisation you trust, to get you to hand over information or money – is called phishing.
ASOS says the information accessed included some names and contact details, and that no payment card information or account passwords were accessed. The full scale of the hack won’t become clear until the investigation is complete, but the important thing to take away from this as a business owner is that this hack didn’t start with a clever piece of code. It started with somebody being convinced that they were dealing with someone they could trust.
It won’t look like a hack
Phishing scams are one of the more common ways a small business may be targeted, and they will rarely look like a hack at all. They could look like:
- An email from a regular supplier saying they’ve changed banks and need you to update their details before you pay their next invoice.
- A message from your web developer asking for an admin login or two-factor code so they can fix something urgently.
- A note from your boss’s personal account, asking you to make a quick payment whilst they’re away.
In some situations, the message may even come from the person’s real email address, if their account has been taken over. On the surface it seems logical and looks authentic, which makes it much harder to spot.
Why it works
These scams are designed to be convincing. Many are based on real, specific knowledge of the company, rather than a broad net cast in the hope that somebody slips up. They rely on you being helpful and busy, rather than careless. The request is normal, the sender is familiar, and the message often arrives when the attackers expect you to be too busy to look twice.
This is why the fix for this type of scam is human – staff training and good habits.
Keeping safe
Any request for sensitive information – logins, access, payments or customer data – should be confirmed in a second way before it’s acted on. The best way to do this is by phone, using a number you already have for the sender, never the number provided in the message.
- Make it official. Make sure your staff know this is a rule, not a suggestion. Include it in training, put written reminders where everyone can see, and refresh the training regularly.
- Tell everyone who could be asked. All your staff need to be trained on the dangers, as well as the steps you’ve put in place to prevent them. This includes apprentices and part-time staff. Make it clear that nobody will ever be punished for double-checking.
- Keep trusted numbers somewhere easy to find. This could include regular suppliers, your bank, your web developer, senior staff and anyone else who may have a genuine need for access to your systems.
- Require approval for money. Any new payee, or change to existing bank details, needs approval from a second person.
- Know where sensitive information is kept. Make sure staff know which of the tools they use can contact customers, store customer details or be used to make a payment.
These rules are free to put in place, and they work whether the scam arrives by email, text, phone or social media.
Need a hand?
For most businesses, these changes are simply a case of creating a procedure and training staff. If most of your payments or approvals run through spreadsheets and inboxes, it may be worth making the checks a required step in your systems, so they don’t rely on somebody remembering. Our free process audit can look at how requests and payments move through your business and tell you honestly what needs doing – if anything. Call us on 01637 222001 or get in touch.