Phishing risk for regulated businesses
Phishing Risk for Regulated Businesses
< BLOG
Phishing risk for regulated businesses: FSB findings
It will not come as a surprise that a similar web address and fake website pose a significant challenge to businesses working within a regulated sector. Many have reported an increase in business impersonation attacks where scammers look to deceive people into visiting the wrong address to gather confidential details.
Why this matters
Regulated businesses are expected to take security seriously. This includes protecting customer information, keeping important services running and responding properly when something goes wrong.
The UK GDPR requires organisations handling personal data to use security measures that are appropriate to the risk. That includes protecting the confidentiality, accuracy and availability of the information they hold.
For financial-services firms within scope of the FCA’s operational-resilience rules, cyber incidents can also affect important business services, customers and the wider market. Firms must identify vulnerabilities, test their ability to cope with disruption and have plans for communicating during an incident.
This does not mean every regulated small business needs an expensive security team. It does mean the business should understand the risks it faces and take sensible, proportionate steps to reduce them. These are internal factors where as a fake website address is an external and outside of the businesses control. This is a phishing risk for regulated businesses, one that The TLD Project addresses.
What the Federation of Small Business found
FSB’s Cracking the Case report found that 72% of small businesses had experienced cybercrime over a two-year period. Of those businesses, 92% said they had been targeted through phishing emails.
Phishing is a message that pretends to come from a trusted person or organisation. It could appear to be from a bank, a customer, a supplier, Microsoft, a delivery company or a colleague.
The message may ask someone to sign in, open a document, approve a payment or update bank details. It is often written to create worry or urgency: “your account is at risk”, “payment is overdue”, or “please review this document today”.
Invoice fraud was also reported by 31% of small businesses in the FSB research. This can happen when a criminal pretends to be a supplier and asks for payment to be sent to new bank details.
The scammer’s process
The scammer starts by choosing a business, service or brand that people already trust. It doesn’t need to be a big brand and in many cases it is not. They then register a web address that appears close enough to look believable when seen quickly.
That address can be used to send emails or host a fake sign-in page. The aim is not always to fool everyone. It is to fool one busy person at the right moment. This is a phishing risk for regulated businesses, their customers, users, suppliers and partners.
The criminal sends a message that looks like part of normal working life. It may be an invoice, an account alert, a request to approve a payment or a message asking the recipient to sign in.
If someone follows the link and enters their details, the scammer may gain access to an email account or business system. If someone accepts changed bank details without checking them another way, money may be sent to the wrong account.
For a regulated business, this can become more than a financial loss. It may involve customer data, a disruption to an important service, a complaint, an incident investigation or a need to notify relevant parties.
Security and compliance
The FSB found that 73% of businesses affected by their most serious cybercrime experienced a financial cost. Thirty per cent said it cost more than £1,000, while 6% reported a cost above £10,000.
Good compliance is not about collecting policies that nobody reads. It is about knowing what could go wrong, showing that reasonable controls are in place and being able to respond when an incident happens.
The ICO says businesses should assess their information risks, put appropriate security measures in place and regularly review whether those measures still work. It also highlights the importance of staff awareness, strong access controls and the ability to detect and respond to attacks. The TLD Project directly addresses the phishing risk for regulated businesses.
For regulated small businesses, checking for online impersonation should sit alongside everyday precautions such as verifying payment-detail changes, using multi-factor sign-in and making sure staff know how to question an unexpected email. It is a practical way to reduce the chance that a criminal can use your name, or someone else’s, to cause harm.
Addressing the phishing risk for regulated businesses at source
The TLD Project was born from a real-world phishing attack. It highlighted the venerability all businesses face with online impersonation. The phishing risk for regulated businesses is far more serious but no less damaging to any business’s reputation.
Registering defensive domain names is one practice, but a business cannot be expected to register every variation – it is not commercially viable. Early warning similar website and email activation is a powerful defense looking to deal with this fraud at source. The TLD Project offers both a proactive and reactive solution to the growing phishing risk for regulated businesses.
