I had a nasty one arrive at work on Thursday: an email, ostensibly from one of our clients asking, "Did you send me this invoce?", with a signature block, phone and fax numbers. The subject line included an "Invoice no."
Obviously there was something nasty at the end of the link.
I run Linux, so it's much harder to get a virus from email (but not impossible, either, so I'm vigilant). We run our own, home-grown, email filtering, too, which integrates several mainstream lists of spam "signatures" from a number of sources, and usually suceeds far better than any one of the main ones on their own, but it got through that.
It's what they call "spear phishing" - a quite well-targeted (personalised) attack, sent during the working day, and designed to catch a busy person on the hop. I don't send out invoices, but I do have customer contact, and the issue that almost caught me was whether the firm had made a mistake - that would've been important.
The one that'll get you is the one that's plausible enough, and written in such a way as to get you to let your guard down.
The other ones I get regularly are quite entertaining: scam award schemes. There are now more "awards" than there are companies (probably). I'm in marketing and get around ten of these every week. "Re: XXXX 2017 - entries now closing." or something similar, and it usually starts "Dear ------, with reference to the email my colleague sent..."
The funniest one of those is rather persistent, trying to get us (an IT company) to be considered for "Accountancy firm of the year". Needless to say, we're not worthy.
Back on track, my daughter has a simple system: to use disposable email addresses for anything risky, such as online shopping with firms she doesn't fully trust, and some social media and university purposes. It's annoying because you have to remember them (and monitor them), but I was recently pleased to see that Plusnet allows a large number of email aliases (more than any normal human might need), so you can create and destroy them at will. Frustratingly, we don't use Plusnet at home! And you will still get the spam, but at least you can track where it came from, and, if necessary alert the Data Protection Registrar that someone has had your details away.
Given how much this stuff costs the economy and individuals, I think we should have much tougher legislation, and possibly even licensing of data users (with regular audit, like a vehicle's MOT). Having your car nicked is bad enough, but having your indentity stolen, etc. can be completely devastating.
[climbs down off soapbox...]
