Scams, fraud, cybercrime – these are significant concerns in relation to electronic equipment. How can the typical consumer beat the inventive new scams taking advantage of this security measure?
Security threats continue to evolve as fast as technology itself does, prompting you to implement robust measures such as two-factor authentication (2FA) to protect our accounts.
However, as 2FA becomes more prevalent, cybercriminals are devising sophisticated strategies to bypass this security layer and gain unauthorised access to your sensitive information.
Trevor Cooke, the online privacy expert at EarthWeb, provides Digital Journal with some effective strategies you can use to safeguard our accounts.
Credential Harvesting Via Phishing
Cybercriminals start their schemes by crafting deceptive emails, messages, or websites that closely resemble legitimate platforms, luring unsuspecting users to enter their login credentials.
Once users fall for the phishing attack and input their username and password, cybercriminals swiftly harvest this information and attempt to access the victim’s account.
While MFA/2FA may prevent immediate access, cybercriminals are already armed with the victim’s credentials, allowing them to initiate fraudulent activities or further exploit vulnerabilities.
Social Engineering To Obtain Authentication Codes
Cooke states: “Once they have your login credentials, phishing attacks move to the next stage. They often employ social engineering tactics to manipulate individuals into divulging their MFA/2FA codes. Cybercriminals may impersonate trusted entities, such as tech support agents or financial institutions, and create a sense of urgency or fear to coerce victims into providing their authentication codes.”
By exploiting human psychology and trust, cybercriminals trick users into willingly handing over their MFA/2FA codes, thereby circumventing this crucial security layer.
Fake Login Pages And Overlay Attacks
Sophisticated phishing campaigns utilise fake login pages or overlay attacks to intercept MFA/2FA codes in real time. Victims are directed to fraudulent login pages that mimic legitimate platforms, where they unknowingly input their credentials and authentication codes.
Behind the scenes, cybercriminals capture these codes in real time, enabling them to bypass MFA/2FA protections and gain unauthorised access to the victim’s account before the victim realises they’ve been compromised.
Account Takeover And Immediate Use Of Stolen Credentials
Once cybercriminals obtain both login credentials and authentication codes through phishing, they swiftly execute account takeovers and initiate fraudulent activities. With access to the victim’s account, cybercriminals may conduct unauthorised transactions, exfiltrate sensitive data, or exploit the compromised account for further malicious purposes.
Cooke advises: “By acting quickly upon obtaining stolen credentials, cybercriminals minimise the window of opportunity for victims to detect the unauthorised access and take corrective actions.”
How To Protect Yourself And Your Business
To defend against these sophisticated phishing tactics and protect against MFA/2FA bypass attempts, individuals and organisations must adopt a multi-faceted approach.
Examples include:
User Education and Awareness
Educate users about the telltale signs of phishing attacks, including suspicious emails, unfamiliar senders, and urgent requests for login credentials or authentication codes.
Advanced Authentication Methods
Implement stronger authentication methods, such as app-based authenticators or hardware tokens, which are less susceptible to phishing attacks compared to SMS-based codes. Encourage users to leverage these advanced authentication methods to enhance security and resilience against phishing attempts.
Phishing Simulation And Training
Conduct regular phishing simulation exercises and security awareness training to familiarise users with phishing tactics and empower them to recognize and report suspicious activity promptly. Provide practical guidance on identifying phishing red flags and responding effectively to phishing attempts, emphasising the importance of vigilance and caution in the face of evolving cyber threats.
