Protect yourself from cyber crime

The most common time for people to suddenly get serious about cyber crime? Right after they fall victim to it. But for high-net-worth individuals, the cost of such a wake-up call can be far too high.

The good news is wealthy people are already worried about cyber crime. A 2016 poll of high-net-worth investors by Morgan Stanley found 72 per cent listed identity theft as an issue they were most worried about.

They ought to be. Australia is rife with online crime and trends suggest the pursuit of high-value targets is increasing.

Australia ranked fourth in the FBI’s 2016 Internet Crime Report for number of victims, ahead of several larger countries, including France and Germany. Meanwhile, the Australian Cybercrime Online Reporting Network is recording a steady increase in cyber crime: 11,800 scams and other crimes were reported in the three months between April and June 2017, up from 10,800 in the same period in 2016.  Email was the most popular vector for attack in both years.

Cyber crime follows the money. Attacks sometimes hit large organisations with a presumed ability to pay. We hear about these when the organisations are obliged to report on them, or because the attack shuts them down, as with the ‘WannaCry’ ransomware attack on Britain's National Heath Service. But organisations are far from the only targets.

It’s personal

When hackers target individuals the attacks are far less public. KPMG Risk Consulting partner Stan Gallo has been involved in several cyber-crime cases involving prominent figures that have never been made public.

“For reputational reasons, et cetera, most victims want to keep that information confidential,” Gallo says.

High net worth individuals are at particular risk. Not only do they have resources hackers would like to appropriate, but often also a public profile that facilitates information gathering. The intent can be to steal, to extort or to publicly embarrass.

The practice is sometimes known as ‘spear-phishing’. Specific targets are identified and pursued, using high effort in the expectation of high reward.

Cyber-crime targeting individuals is largely hidden from public view. We hear of a few especially high-profile cases. The following are exceptions:

• A large number of celebrities including film actor Jennifer Lawrence had photographs leaked online in 2014.
• David Beckham had emails leaked when his public relations agency was the victim of an extortion attempt.

Information is power

Personal information can be a valuable intermediate step towards a bigger hack, and it is often available to hackers at a price, says KPMG’s Gallo.

“There is a lot of information available on the dark web,” he says. “It’s not just email addresses but user IDs, passwords, accounts – both financial and social media. A lot of sensitive information is available there if you know where to find it.”

Hackers exploit mass hacks – such as when over 100 million logins and passwords were stolen from LinkedIn in 2012 – to get details on high profile people. But sometimes information is on the internet in plain sight.

As a convicted cyber criminal told The Financial Times in 2016: “LinkedIn is a very good tool to find out people’s job titles … people post a lot of publicly available information about themselves online that is very useful.”

“There is a lot of information available on the dark web. It’s not just email addresses but user IDs, passwords, accounts."

Stan Gallo, KPMG

When a chief executive officer loses control of their identity, it can cost their business dearly. Hackers have found impersonating CEOs to obtain wire transfers can be very lucrative. The ploy is known as business email compromise (BEC).

“BEC is a serious threat on a global scale,” says FBI special agent Martin Licciardo, an organised crime investigator. “And the criminal organisations that perpetrate these frauds are continually honing their techniques to exploit unsuspecting victims.”

Playing defence

High-net-worth individuals need to stay a step ahead to avoid being brought down, says Gallo.

He recommends basic security hygiene such as:

• deploying two-factor authentication where possible
• updating antivirus software
• not reusing passwords across multiple accounts
• being very wary of using public Wi-Fi.

Really good defence involves controlling what information hits the internet, Gallo says, and that is not about technical solutions.

“Sometimes it is not just the person publishing, it might be their children or their spouse or partner,” he says.

“Whether they are a member of a board or a C-suite executive they should encourage that cultural mindset in their staff as well their family. Practice yourself but also preach it. Make sure that awareness is with anyone who acts on your behalf or has authority over your assets.”

 

Jason Murphy is an economist, media commentator, journalist and corporate writer based in Melbourne.

 

To discuss what this insight could mean for you, talk to your ANZ Private Banker directly, or contact us below.