[{"data":1,"prerenderedAt":23},["ShallowReactive",2],{"$f0QCoQWwW1Vwj0eBH_ZBZoPn-ZCOtXAWn75nrFr15w2E":3},{"id":4,"slug":5,"url":6,"date":7,"modified":8,"title":9,"excerpt":10,"content":11,"featuredImage":12,"featuredImageAlt":9,"tags":13,"categories":18},596,"asos-hack-fake-trusted-contact","https://blog.grizzlyware.com/asos-hack-fake-trusted-contact/","2026-10-13T11:20:53","2026-10-13T11:20:55","The ASOS hack started with a fake ‘trusted contact’. Would you spot one?","\u003Cp>Most of us can spot a scam from a stranger. But it’s harder when it’s a normal-looking request from someone we know. Here’s one simple rule that protects your business.\u003C/p>\n","\n\u003Cp class=\"wp-block-paragraph\">\u003Cem>Part 3 of 5 in our October series: small, free steps to take control of your own cyber security.\u003C/em>\u003C/p>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">Most of us like to think that we could spot, and avoid, a scam email or text. We’ve all seen the emails from a prince with a fortune to share, and the texts about a parcel we never ordered. The red flags are obvious, and we delete them without a second thought.\u003C/p>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">But some scams are much harder to spot. Perhaps it’s just a very ordinary-looking request from a colleague asking for the password to the shop admin area, or your web developer asking you to send them the two-factor code you’ve just received by email. Perfectly reasonable requests on the surface – would you be able to tell which are genuine?\u003C/p>\n\n\n\n\u003Ch3 class=\"wp-block-heading\">\u003Cstrong>What happened at ASOS\u003C/strong>\u003C/h3>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">If you’ve seen the news in the last week, you’ll know that on 6th October, ASOS app users received a push notification from the company’s own app claiming that it had been hacked.\u003C/p>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">While the investigation into the full extent of the impact is ongoing, we now know how the hackers gained access.\u003Ca href=\"https://www.asos.com/customer-care/engagement/unauthorised-asos-notification/\"> ASOS explained\u003C/a> that “an unauthorised party gained access to an ASOS employee account by impersonating a trusted contact to obtain log in credentials”. Those credentials were then used to access information on third-party platforms used by ASOS. This type of hacking – when someone pretends to be a person or organisation you trust, to get you to hand over information or money – is called phishing.\u003C/p>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">ASOS says the information accessed included some names and contact details, and that no payment card information or account passwords were accessed. The full scale of the hack won’t become clear until the investigation is complete, but the important thing to take away from this as a business owner is that this hack didn’t start with a clever piece of code. It started with somebody being convinced that they were dealing with someone they could trust.\u003C/p>\n\n\n\n\u003Ch3 class=\"wp-block-heading\">\u003Cstrong>It won’t look like a hack\u003C/strong>\u003C/h3>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">Phishing scams are one of the more common ways a small business may be targeted, and they will rarely look like a hack at all. They could look like:\u003C/p>\n\n\n\n\u003Cul class=\"wp-block-list\">\n\u003Cli>An email from a regular supplier saying they’ve changed banks and need you to update their details before you pay their next invoice.\u003C/li>\n\n\n\n\u003Cli>A message from your web developer asking for an admin login or two-factor code so they can fix something urgently.\u003C/li>\n\n\n\n\u003Cli>A note from your boss’s personal account, asking you to make a quick payment whilst they’re away.\u003C/li>\n\u003C/ul>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">In some situations, the message may even come from the person’s real email address, if their account has been taken over. On the surface it seems logical and looks authentic, which makes it much harder to spot.\u003C/p>\n\n\n\n\u003Ch3 class=\"wp-block-heading\">\u003Cstrong>Why it works\u003C/strong>\u003C/h3>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">These scams are designed to be convincing. Many are based on real, specific knowledge of the company, rather than a broad net cast in the hope that somebody slips up. They rely on you being helpful and busy, rather than careless. The request is normal, the sender is familiar, and the message often arrives when the attackers expect you to be too busy to look twice.\u003C/p>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">This is why the fix for this type of scam is human – staff training and good habits.\u003C/p>\n\n\n\n\u003Ch3 class=\"wp-block-heading\">\u003Cstrong>Keeping safe\u003C/strong>\u003C/h3>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">Any request for sensitive information – logins, access, payments or customer data – should be confirmed in a second way before it’s acted on. The best way to do this is by phone, using a number you already have for the sender, never the number provided in the message.\u003C/p>\n\n\n\n\u003Col class=\"wp-block-list\">\n\u003Cli>\u003Cstrong>Make it official.\u003C/strong> Make sure your staff know this is a rule, not a suggestion. Include it in training, put written reminders where everyone can see, and refresh the training regularly.\u003C/li>\n\n\n\n\u003Cli>\u003Cstrong>Tell everyone who could be asked.\u003C/strong> All your staff need to be trained on the dangers, as well as the steps you’ve put in place to prevent them. This includes apprentices and part-time staff. Make it clear that nobody will ever be punished for double-checking.\u003C/li>\n\n\n\n\u003Cli>\u003Cstrong>Keep trusted numbers somewhere easy to find.\u003C/strong> This could include regular suppliers, your bank, your web developer, senior staff and anyone else who may have a genuine need for access to your systems.\u003C/li>\n\n\n\n\u003Cli>\u003Cstrong>Require approval for money.\u003C/strong> Any new payee, or change to existing bank details, needs approval from a second person.\u003C/li>\n\n\n\n\u003Cli>\u003Cstrong>Know where sensitive information is kept.\u003C/strong> Make sure staff know which of the tools they use can contact customers, store customer details or be used to make a payment.\u003C/li>\n\u003C/ol>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">These rules are free to put in place, and they work whether the scam arrives by email, text, phone or social media.\u003C/p>\n\n\n\n\u003Ch3 class=\"wp-block-heading\">\u003Cstrong>Need a hand?\u003C/strong>\u003C/h3>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">For most businesses, these changes are simply a case of creating a procedure and training staff. If most of your payments or approvals run through spreadsheets and inboxes, it may be worth making the checks a required step in your systems, so they don’t rely on somebody remembering. Our\u003Ca href=\"https://www.grizzlyware.com/blog/business-process-audit\"> free process audit\u003C/a> can look at how requests and payments move through your business and tell you honestly what needs doing – if anything. Call us on 01637 222001 or\u003Ca href=\"https://www.grizzlyware.com/contact-us\"> get in touch\u003C/a>.\u003C/p>\n\n\n\n\u003Ch2 class=\"wp-block-heading\">Related articles\u003C/h2>\n\n\n\n\u003Cul class=\"wp-block-list\">\n\u003Cli>\u003Ca href=\"https://www.grizzlyware.com/blog/cyber-security-for-small-businesses-nine-things-that-cost-nothing/\">Cyber security for small businesses: nine things that cost nothing\u003C/a>\u003C/li>\n\n\n\n\u003Cli>\u003Ca href=\"https://www.grizzlyware.com/blog/online-shop-plugins-weakest-link\">Your online shop’s plugins could be its weakest link\u003C/a>\u003C/li>\n\u003C/ul>\n\n\n\n\u003Cp class=\"wp-block-paragraph\">\u003C/p>\n",null,[14],{"id":15,"name":16,"slug":17},134,"Cyber security for small businesses: nine things that cost nothing","cyber-security-for-small-businesses-nine-things-that-cost-nothing",[19],{"id":20,"name":21,"slug":22},125,"Security","security",1791887204513]