Yotam Dar, tech entrepreneur and expert in cybersecurity as it relates to blockchain, shares three ways cybersecurity scams have been evolving.
An online safety bill has been introduced recently, but Google says this may not necessarily protect people particularly when it comes to scam ads. A study by Scamadviser covering 31 countries and representing 60 percent of the global population shows that the volume of scams has increased considerably, at 40 percent, in the past year. The cyber scam problem is worsening and it seems a deceleration let alone an end is nowhere in sight.
It would be inaccurate to say that there have been minimal or no efforts to stop these scams. As mentioned, legislation has been invoked and various organizations have instituted systems and protocols to keep scammers at bay. Unfortunately, their tactics and techniques perpetually evolve, and keeping up is becoming a tall order.
Here’s a rundown of the different ways cyber scams are evolving to become more effective at deceiving victims and evading security controls.
1. Following trends
Scams evolve with the trends. Scammers go where people are after all. At some point, there were murmurs about email becoming obsolete because of the growing popularity of messaging services and social media. In response, scammers retooled their attacks to become more suitable for instant messaging and social media interactions.
Perpetrators of the “Nigerian” or advanced-fee scams redirected their efforts to social media and messaging apps as they found more potential victims in these new communication platforms. When their tactics became obvious and effectively avoided by potential targets, they turned to new attack approaches, particularly expert impersonation.
On the other hand, the emergence of crowdfunding also did not escape scammers’ radars. The FinTech idea that supposedly seeks to help people has also become a tool for hurting people. Some put up businesses that introduced interesting new products or new business models to attract investments from retail investors. Others establish crowdfunding drives to raise funds for hospitalization or help someone. In the end, they turned out to be fraudulent just like the case of iBackPack, whose owner pocketed most of the crowdfunding proceeds.
The rise of Bitcoin also opened up opportunities for scammers to swindle people. Many likely noticed the deluge of ads about crypto investments online. Some offer the chance to profit from the growing bitcoin price while others entice investors to put their money in initial coin offerings (ICOs). Many have become victims of false promises and deceptive financial schemes. In fact, according to the FTC, the popularity surge of cryptocurrency has led to record investment scam losses among Americans.
Even online shopping has become an avenue for scammers. Some commit slight deceptions by claiming to offer the lowest prices in their ads and social promotions when they actually have one of the highest prices. Others go all out by selling defective and sometimes nonexistent products. They manage to create a perception of credibility among buyers by fabricating customer reviews and ratings or using paid trolls to simulate engagement.
Notably, the pandemic has become a fertile breeding ground for scams. As people spend more time online, scammers go into overdrive with a wide range of schemes. Some offer fake access codes to online streaming and other internet services. There are also those that take advantage of newbie online sellers as well as buyers who know little about undertaking online transactions.
The so-called “fine print” scams exploit the cluelessness or lack of experience of many who are new to the dynamics of doing things online. For example, some consumers unknowingly subscribe to a streaming or other online service indefinitely after giving out their credit/debit card numbers or bank account details. They are forced to enter into an agreement that allows a company to automatically charge their debit/credit cards for a service, a detail that many customers may not notice or pay attention to because of fine print deception.
2. Using precursors
The evolution of cyber scams is also aided by things that may not appear to be directly related to the attacks. For example, when scammers encountered serious obstacles in harvesting email addresses because of the standardization of email address anonymization or concealment online, they turned to creative ways of sourcing emails and other information about potential customers.
Scammers employ false surveys, ads, pre-approval schemes, and other illicit data collection methods to make internet users unwittingly volunteer their information, which in turn become starting points for scammers who are seeking targets. Cybercriminals are getting better at finding ways around automated solutions versus scams and other cyber threats.
Through discreet customer data collection, scammers come up with more effective methods to catch their victims. They get to study the interests and financial behavior of their targets and use custom copies or content that are most likely to resonate with the potential victims.
3. Preying on human weaknesses
Ignorance, carelessness, gullibility, overindulgence: These are human characteristics that have largely remained unchanged even as information technology progressed. No matter how easy it has become for people to do some research online to verify something, the tendency to forego prudence to respond to a phishing email about winning a multi-million lottery prize, for example, is something many could not shake off.
Not knowing enough, refusing to investigate something they don’t know enough about, easily believing something, and being overeager in engaging with something are human weaknesses cybercriminals are grateful their prospective victims refuse to address. Basically, they have become largely a constant for many internet users.
This constancy may sound antithetical to evolution, but it actually does help cyber scams evolve. How? By providing an easy go-to vulnerability for cyber attackers to exploit whenever their attacks are exposed or rendered invalid.
For instance, when email service providers started displaying warnings or notifications on emails received (e.g., Gmail’s “This message seems dangerous” alert), email scam perpetrators enhanced the content of their scamming emails. They wrote more compelling copies, added graphics, or emulated the email templates of organizations users usually interact with like ISPs or utility companies.
The familiarity of an email format and the strong pull of an effective call-to-action message (example: “Offer expires in 12 hours!”) tend to disarm even those who are typically careful in opening emails and links. Renowned cybersecurity expert and computer scientist Daniela Oliveira refers to this as an exploitation of the propensity of people to be in automatic mode, wherein people respond quickly, intuitively, and emotionally.
Similarly, when web browsers and cybersecurity started integrating link scanners to advise internet users about potentially harmful web pages, scammers also managed to convince their prospective victims to click on links because of the improved compellingness of the content they put out.
The term social engineering emerged precisely because people continue to be manipulable. Even when they get the assistance of automated cybersecurity tools, scammers are still able to convince many to ignore or deliberately turn off certain security controls and unwittingly allow a cyber scam to succeed.
How to beat cyber scams
Cyber scam evolution is admittedly unstoppable. Not even laws can put an end to these threats in the digital world. Scams will continue to improve and become more effective at defrauding people by taking advantage of new technologies, using the new platforms or services, and most importantly, by exploiting the weaknesses among people.
The best that can be done is to be aware of scam tactics and techniques and have a systematic approach in detecting and preventing them. They may not be completely eradicated, but their impact can be made manageable by educating everyone in an organization, using relevant cyber protection tools, harnessing collaborative cyber threat intelligence resources, and improving defenses in line with how scams are evolving.
