The Covid-19 pandemic has brought about a digital transformation in all spheres: schools found themselves having to conduct classes and all interaction with pupils via internet, while a large number of companies introduced teleworking between their teams and continue to work remotely or combine this with on-site activity at their offices.
But it doesn’t stop there. A study confirms that the creation of new domains in Europe is up by 20% because of the pandemic, an increase most likely stemming from the fact that most businesses have had to undergo a transformation and get online to be able to keep offering customers their products and services.
Yet the digital transformation has its downside too, with cyberattacks mushrooming in 2020 and half of them attributable to the increase in teleworking caused by the pandemic: “Over half of organisations weren’t ready for the digitalisation needed to implement teleworking”, affirms a study by ACCIÓ and the Cybersecurity Agency of Catalonia.
The same study states that “on a global scale estimates put the rate of cyberattacks in 2021 at one every eleven seconds. This figure has risen considerably in recent years: in 2016 the average was 40 seconds”.
One of the most common forms of IT attack is ransomware, with malicious software or a virus encrypting the whole content of a computer and demanding a ransom to decrypt it. Another is phishing, involving the fraudulent supplanting of identity and aimed at businesses and individuals alike: recipients get an email or mobile phone message requesting data or passwords. One of the most common scenarios is where a bank is imitated, with the recipient getting a message asking them to confirm a user ID and password which are then used to access the account.
How to spot internet fraud?
A quick check of the domain the message is trying to direct us to is one way to detect this. With both ransomware and phishing, it’s likely they’re trying to supplant the identity of recognised organisations to either get us to download a virus or to get access to our user data. But one important datum they can’t supplant is the domain of the real organisation.
Carrying on with the bank as an example, imagine you’re contacted by your bank, “Bank Segur”, and you know their website is bancsegur.barcelona. If you get a message from the bank asking you to access a page with the domain bancsegur.xxxxx.barcelona, here’s your clue that this is a fraud. Why? Because in this case the domain is xxxxx.barcelona, and bancsegur.xxxxx.barcelona is a subdomain. In other words, we should always look at what comes just before .barcelona (or .cat, .com, .es etc.).
If you’re still unsure, the best thing to do is not to reply to the message and to contact the organisation another way, via their customer service phone line, social media or the email address on the website you usually use.