Asked how to help nonprofit staff resist increasingly convincing phishing, the IT security guest says training helps, then tells this story. His point is that even obvious scams still work.
…anywhere from as simple as somebody just getting access to somebody's inbox and being embarrassed by that incident to somebody scamming a nonprofit out of hundreds of thousands of dollars through redirecting a wire transfer from a phishing email. So these threats are real and they happen every day.
…nonprofit folks who just are eager to help, right? If the boss says, hey, I need your help on this, they tend to jump in. So, are there ways that, how do we help them to not do that? How do we help them to be smarter around some of these things that you guys are seeing come in as attacks right now?
It's the basic educational type approach. You know, I think everybody that has a compliance issue, cybersecurity insurance, and things like that, are required to do security awareness training. Security awareness training saves a lot of people from these cyber attacks. And you would think that it's so simple that everybody's heard of somebody getting scammed and sent to Target to get to get the gift cards. And it still happens today. You know, it's probably happening to somebody right now as we're talking. And some of the attacks I've seen are very sophisticated and really good. Well done. And some of them are very bad to the point where if you just read the email, you would say there's no way somebody would fall for this. And a CFO actually sent $167,000 to a hacker with a really bad email that it didn't even spell the organization's name correctly.
Stop it. $167,000?
Yes. And I got the call from an executive director about 8 p.m. on a Thursday night. And I read the email going, How could somebody fall for this?
Yeah.