Businesses targeted in email phishing schemes don’t always have to play the victim. They can actually fight back.
Businesses targeted in email scams don’t always have to play the victim. They can actually fight back.
Researchers at Dell SecureWorks have documented how they identified a suspected email scammer from Nigeria by essentially playing along with the scheme to fool the attacker into revealing his true whereabouts.
Anyone can use these tips, said Joe Stewart, director of malware research at SecureWorks. “We’re letting [the scammers] give us all the information about themselves,” he said.
The email scheme involved a fraudster impersonating a CEO in what’s called a business email spoofing attack. The goal is often to trick a victim into wiring funds to the scammer’s bank account.
Although a business can train its employees to learn how to spot these suspicious emails, that won’t necessarily stop the attack, especially since it’s easy for anyone to continually bombard a victim with emails, SecureWork said.
Instead, a business’ IT security staff can fight back and disrupt the scammer’s operations. They can do this, by first replying to an email scam and pretending to act like a gullible victim.
This was how SecureWorks managed to eventually identify an email scammer from Nigeria that targeted a U. S. technology company in November. SecureWorks was brought in to investigate and decided to fool the fraudster into thinking his scheme had worked.
