Hackers Use Social Media to Exploit Direct Deposit Accounts

This is an archived article and the information in the article may be outdated. Please look at the time stamp on the story to see when it was last updated.

Photo: MGN Online

According to Beazley.com, a cyber insurance firm, “Hacks and malware accounted for 40% of financial institution data breaches in 2016, up from 27% in 2015. Unintended disclosure – mainly caused by misdirected emails – was also up, rising to 28% of breaches in 2016 from 24% in 2015.”

Within this report is an alarming description of how hackers are exploiting direct deposit accounts, racking up more than $800,000,000 in losses.

The National Federation of Independent Business (NFIB) estimates that nearly 60% of all employees use direct deposit to receive their paycheck each month. With ACH transfers totally nearly $41 trillion per year, this system of payment is ripe for attack making it critically important that businesses take appropriate security measures.

Here’s how the hack unfolds.

First hackers identify prospective victims by searching social media accounts, personal and corporate, to find post from employees of a target company.

If an employee posts a comment or picture from a corporate account, savvy hackers can tract back to their corporate email account server to hijack that employee’s email account and identify the payroll service provider.

Once done, the hacker will redirect direct deposit emails to a junk mail folder, to avoid detection.

Next, the hacker requests a password reset from the payroll provider and then changes the employee’s direct deposit account information. From this point forward, the hacker can redirect payments with ease.

With a median loss of over $90,000 per case, this is a very lucrative target for theft. So how can a company protect itself from this type cyber-attack? Check out the following tips:

  • Set up extra layers of security between company servers and third-party payroll service providers.
  • Consider Two-Factor Authentication for access to email accounts and financial or payroll information.
  • Set up manager approval procedures for any changes made to employee payroll accounts.
  • Don’t post job duties and descriptions or out-of-office details on social media accounts.
  • Set user access rights to limit the ability to change payroll account information.
  • Monitor all payroll change reports from internal staff or payroll provider.
  • Alert employees to not click on links or open attachments from any unsolicited email.
  • Make certain that company computers have the most up to date anti-virus, ant-malware, and anti-exploit software installed. Require you payroll service to follow the same security procedures. Third-party vendors with inadequate data security are often a hacker’s gateway to company servers and sensitive information – like bank accounts and employee W-2’s. Sources: BBB.org, KnowB4.com, and FullyAccountable.com.

For more information go to Cyber Insurer Beazley Sees New Phishing Threats Emerge, Beazley Breach Insights, and Outsmart Business Fraud with Internal Controls.

If you would like to report a scam, call your BBB at 256-533-1640 or go to the BBB Scam Tracker. To find trustworthy businesses, visit bbb.org.

BBB North Alabama News Release: Hackers Use Social Media to Exploit Direct Deposit Accounts

Notice: you are using an outdated browser. Microsoft does not recommend using IE as your default browser. Some features on this website, like video and images, might not work properly. For the best experience, please upgrade your browser.