Fraud and Cyber Crime

By far the most problematic area for firms is that of fraud and cyber crime.  As identified by the SRA, one of the main ways in which malicious or destructive software can get onto networks and devices is through email.  Links to viruses and malware download sites and infected attachments are the most common ways in which this is achieved and users need constantly to be alert to the fact that, if they are at all unsure about the source of an email they should not be following any links or opening any attachments.

Another way in which emails can be used as a vehicle for fraud is using phishing emails.  These are intended to persuade users to impart personal information by pretending to have come from a reliable sender – for example a business that the user would assume to be trustworthy, an official organization such as a bank or a government departments, a genuine website, or a reputable online service.  Those who carry out phishing tend to do it using emails and websites that are made to look like the genuine email or website of the organisation being impersonated.   If in doubt do not follow any links, reply with any information or download any attachments.

Email users must be very alert to this as the fraudsters who use this method are getting ever more devious. For example, some phishing emails fool the user into thinking that their bank or online account has been compromised and that they need to act quickly by providing the details set out in the phishing email. Usually that information will include their username and password to an account. All email users need to be vigilant and staff need to be made aware of the fact that they must never respond to these emails.

One easy way to check whether a link or web site is genuine is to hover over the link with a mouse pointer and see whether the address for the link corresponds to the genuine address for the web site.  Thus, if the email purports to come from Bloggs & Co Solicitors, whose web address is www.rty-ew.ru/bloggssolicitors then this is likely to be someone passing themselves off as Bloggs Solicitors – no matter how convincing the email looks.  The SRA regularly publish details of fraudulent emails and web sites on their own web site at www.sra.org.uk/alerts/ and it is even possible to have them sent to your Facebook page so they can easily be checked on your phone or tablet.

Apart from fraudulent emails intended to trick there remains the old, ubiquitous problem of spam.  Spam, or junk mail, is any unwanted email that is sent to your inbox.  Often it serves no purpose other than to annoy although it can also be used to advertise a product, service, or event.  Although mostly harmless, spam can however be used to introduce malware to your device or be part of a phishing attack.

So, to remain safe, all partners and staff should be advised to ignore and/or delete unsolicited emails, not to click on any attachments or links unless they are absolutely sure of their provenance and to follow these simple rules:

• Always be wary of any email that asks for confidential information – especially if that information is about financial matters, a client, logins and passwords, personal data or information about the firm. Most genuine emails from legitimate senders will not seek sensitive information by email.  If in doubt contact the sender USING AN INDEPENDENTLY VERIFIED EMAIL ADDRESS OR TELEPHONE NUMBER and check whether the request is genuine.
• If an email suggests clicking a link to go to a web site, rather than using the link provided open a browser and search for that link or company and follow the browser search suggestion. Again, if there are doubts as to whether a particular company sent an email contact them and check.
• Never let yourself be hurried or pressured into giving away sensitive information. Fraudsters like to scare users into making a rash decision in haste so that the user does not have time to question the validity of the message. Things to watch out for are emails telling you that you are about to have money taken from your account by fraudsters unless you phone your bank and provide them with your bank details, that an account is about to be disabled unless you login and update your personal information or that your “allowance” has been exceeded for things such as email or cloud storage or for the use of a service and that you need to login to an account to deal with it. As ever, contact the genuine version of the alleged sender of the message directly to confirm the authenticity of their request.
• Don’t regularly sign up to web sites and newsletters without first checking their privacy policy to make sure that they will not sell your details as part of a mailing list. A considerable proportion of the spam you receive (including potentially dangerous phishing emails) comes as a result of sites you have signed up that have passed on or sold your details to another company. Most reputable commercial websites will have a privacy policy (a link to which can normally be fund at the foot of their home web page) which will confirm whether or not your details will be made available to others.
• Be aware of emails and requests that are badly worded or contain spelling and grammar errors or use idiomatic phrases and expressions that sound as if they have been translated by someone for whom English is not their first language. Also, be aware that fraudulent emails will often not be personalised to the recipient because they are being sent out to a huge number of potential victims. Fraudsters know that 99% of recipients will not respond – it is enough if 1% do – so they send out many thousands of emails.  Thus, an authentic email from someone with whom you have done business is likely to contain a reference or account/customer number and is likely to be addressed to you by name. Many phishing emails, however, will be addressed “Dear Sir/Madam”, and may even come from a bank with which you don’t have an account.
• Under no circumstances send confidential information via a form within an email.
• Make sure any anti-spam/virus software is effective and kept up to date.
• Finally, don’t visit untrustworthy websites or download unevaluated freeware or shareware NO MATTER HOW URGENT THE NEED.

Confidentiality

A major risk for any law firm comes from inadvertent or intentional breach of confidentiality in an email or electronic message.  The need to protect client, personal and other confidential information is vital to ensure that the firm complies with regulations and legislation and it is essential that partners and staff be made aware that using ordinary, open emails can have the same lack of confidentiality as sending a postcard through the post. It should always be assumed that an email can, and will, be read by anyone and any attachments downloaded by anyone.

Given the ubiquitousness of emails already referred to this is not always easy and firms need to consider how they are to maintain confidentiality. It is absolutely essential, therefore, that EVERYONE in the firm does NOT send confidential information through the ordinary email unless it is securely encrypted and in particular that commercial email services such as Hotmail, Gmail and Icloud are not used for business purposes.

A further point of which to be aware is not to use email inboxes (which are inherently insecure) for the storage of confidential information. Email is intended to be a method of communication, not storage, and therefore important emails should be filed in the same way that important letters or documents would be – in the client file – rather than being kept in the email system.

Not that all breaches of confidentiality come about as a result of intentional fraud or criminal activity.  Inadvertent breach can occur and the most common way for this to happen is from information being sent to the wrong person or the wrong attachment being added to an email to the right person.  Be particularly wary of “Reply to All” as the sender can never be sure as to whom the original email was sent.  Far better to do a reply and then add any additional recipients one at a time.

Among the steps that users can take to ensure that confidentiality is not breached are:

• Do not redirect or forward emails from an office email account (which might be a secure account) to an external or personal email account such as Hotmail or Gmail. These accounts are not only more likely not to be secure but may also store data outside the EU and place the firm in breach of Data Protection legislation.
• Always double-check that the correct email address has been used before sending an email.
• Never reply to an email immediately as a ‘knee-jerk’ reaction. Wait and reply in a considered manner which will provide the opportunity to correct the email or have second thoughts as to the security of the recipient.
• Never put confidential information in the body of an email or in an attachment unless it is encrypted and the encryption pass-phrase has been communicated to the recipient BY MEANS OF A DIFFERENT COMMUNICATION METHOD. That means using a text or phone method – not just another email which could also be intercepted. Remember confidential client information belongs to the client, not the firm and the firm does not have the client’s permission to take risks with their data.
• If you don’t have bespoke secure email facilities in your firm, consider using a secure email service such as ProtonMail, Tutanota or Mailfence and suggest to clients that for the purposes of a confidential transaction they do likewise
• Warn the recipient beforehand if you are sending an email which contains confidential information so that they only open it, or any document attached to it, in a secure environment. Include the word “CONFIDENTIAL” either in the email header or the attachment’s file name.
• Avoid the use at all times of the auto-complete function. Not only can address lists become corrupt or out of date – resulting in the email being sent to someone unexpected – but there may be autocomplete data that you did not wish to transmit.
• Beware of keylogging software that might have got onto your computer as this could breach confidentiality. Key-loggers capture what you type right from your keyboard – before any secure email encryption software can protect it.
• Be aware of your surroundings when accessing emails – especially on a mobile device. Someone could be reading over your shoulder.  The best policy is not to access confidential or sensitive information in a public place.
• Don’t leave mobile devices and computers unguarded. If you leave your desk log out and make sure messages are not left on screen.
• Never write down or share any passwords.

To summarise the dangers of emails, it is probably safest if all users assume that anything which can be done to intercept information or fraudulently gain access to accounts will be done, or at least attempted, at some point during the year.  Then, if it doesn’t you can be pleasantly surprised.

Other Email Risks

The preceding highlights two of the risks that exist with the use of emails.  We will look at other risks including risks to time management, information overload, discrimination and cyber bullying, misunderstandings, tone of voice and lazy practices in a future article.