8 ms·
While I think everyone should be aware of phishing, I don't think any amount of education can reliably prevent this sort of fraud. I see this fundamentally as a
by scott_s 8y ago
While I think everyone should be aware of phishing, I don't think any amount of education can reliably prevent this sort of fraud. I see this fundamentally as a process problem, as I assume email was a common way of changing payment information. Email needs to be taken out of the loop.
- r00fus 8y ago> I don't think any amount of education can reliably prevent this sort of fraud. The (possibly remedial) education isn't to prevent the fraud, it's to make your population more resistant to it. At some point in the far future if it's part of basic education courses, then we may create herd inoculation effect where phishing fraud may become unprofitable enough to further depress likelihood (like highway banditry of days yore). Email will never go away - it will always be some part of the payment process even if it's just remittance. It's too ubiquitous.
- badrequest 8y agoI wonder if GPG could have ensured this didn't happen.
- HarryHirsch 8y agoWhen you use Microsoft Safelinks URL rewriter you preclude cryptographic signing. The Safelinks crap is just crap, it obfuscates URLs and you can't sign your messages any longer.
- upofadown 8y agoObviously it could of if applied correctly. That's an interesting point in general. People are still using insecure communications with no sender verification while doing business here in the 21st century.
- na85 8y agoI disagree. Taking email out of the loop is a technical solution to a problem that is inherently social, not technical.
- scott_s 8y agoI don't see it as a technical solution, but fixing a broken process.
- na85 8y agoBut the process is broken by people not realizing that invoices are fraudulent. The method of delivery, be that email or some other system, is completely orthogonal. Running their invoices through SAP or having gpg signed pdf invoices or using more node.js would not help because all of those solutions fail to address the fact that people are dumb and need to be trained to avoid scams.
- hunter2_ 8y agoIf a (insert centralized service here) friend tells me about a change of plans, and I know that messages with that contact were successful in the past, then plans indeed changed because it's spoof-proof so long as you didn't make friends with two accounts that end up sharing a name and so long as the sender didn't fall victim to phishing of creds. If an email from a contact comes in, the from/sender headers can be spoofed without anyone having fallen victim yet, so maybe plans didn't really change. Yes there are social aspects but there is also this plainly technical aspect.
- scott_s 8y agoYes, the problem is people on the paying side not realizing that payment change requests are fraudulent. So a better process removes people on the paying side routinely changing payment information. Require that payees sign into a separate service and they change the payment information themselves.
- upofadown 8y agoNote that in this particular case the email in question had a signed document attached. So the scam could of been done with regular mail.The problem here was the lack of verification, not the medium of communication. The ease of forging emails is more of an issue where the spear phish email is trying to disguise itself as coming from inside the company.
- scott_s 8y agoWhich is why I said it's a process problem. But you definitely want email out of the process since it's not reliable.