Digitalization of society and increased use of services on smart devices or computers both by companies and citizens bring about increased exposure and vulnerability to computer crimes. While most companies have established risk reduction processes by educating the staff and improving their protection systems, citizens are paid very little attention. To be able to move ahead with certainty, public awareness of the risk existence must be raised and protection against this threat must be integrated into the education system to ensure that young generations are prepared for the future.
Comfort and delusion have long been present in this region, as if we are safe from the exponentially growing cybercrime and frauds worldwide, just because we are a small country and a small economy that is of no interest to these criminals. It is somewhat understandable given the small number of “made-to-measure” attacks in the last years, most often using “ransomware” (malware that encrypts all computer data and requires a ransom to be paid for the data to be decrypted), and aimed primarily at companies and financial institutions, due to the higher likelihood for criminals to make maximum profit.
Times are changing and according to crime statistics from 2018-to 2021, the number of these crimes has been increasing by 20% every year*. It is not only that number changes, but the target group of these attacks. A growing number of citizens are being targeted for attacks, because of a specific reason along with an appropriate explanation. Companies and financial institutions, on one side, are continuously improving the systems and educating the staff to develop greater resilience to computer attacks and frauds, thus ensuring that being conquered is more difficult, while citizens, on the other side, are much less educated and less protected from such attacks.
Additionally, the demand and price of citizens’ personal data (including financial data) on the black market are on the constant rise, while trade and services digitalization and electronic payments enhance the number of “vulnerable” points of citizens.
Two groups of computer attacks on citizens
In general, attacks on citizens can be divided into two groups. The first group includes fraudulent attacks aimed at directly, illegally downloading/stealing funds and includes payment card fraud and electronic banking, while the second group includes attacks aimed at extracting as much citizen’s data as possible to later sell them on the black market or misuse them for financial fraud.
One recent example of fraud directed at citizens is the fraud committed at the beginning of February this year, when many citizens received an e-mail message in which they, on behalf of AD Poshta na Severna Makedonija, were asked to pay 10.2 MKD for customs clearance for a shipment. The first reason for doubt is the amount because the lowest denomination of the Macedonian denar is 1 MKD and no legal entity may use a denomination less than this. Furthermore, the e-mail message is sent from a server in Canada and leads to an online payment card portal that is fully arranged to look like it belongs to AD Poshta na Severna Makedonija with all the logos and attributes, and even the URL is configured to act as if it is legitimate (https://posta-mk.ddns.net…).
Once all payment card details are filled in, as well as for each e-commerce transaction, the transaction is forwarded by criminals to a legitimate online store in France, not with the amount of 10.2 MKD, but with an amount of 2000 to 4000 EUR, starting from the larger amount. For each transaction, the user receives a message with an OTP password (one-use password) from their bank showing the actual amount of the transaction. If the user enters the password without paying attention to the actual amount indicated in the message and he/she has that amount of money on his/her account, the money will be transferred. Otherwise, if the user does not have that amount of money, the transaction will be unsuccessful, but most often criminals will try to make another transaction with a twice lower amount, and so on. In this way, they check whether the card entered is valid and what is its limit.
This fraud falls into the category of so-called phishing, where a seemingly valid e-mail message is sent to a large number of users as a kind of a lure to provide their personal/financial data that will be further misused by criminals. Unfortunately, over one hundred citizens succumbed to this fraud.
How can we prevent this from happening?
First and foremost, one should very cautiously approach any e-mail message that asks for personal or financial data. This is especially important if you are not the first to initiate communication or payment with the sender of the message.
At the same time, you need to check the message in detail by comparing the displayed name of the sender (display name) with the actual email address from which the message was sent. In the received message one should select the “show details” option, where all sender details and the original email address can be seen. If the address does not end with the official domain of the represented sender (for example …@ posta.com.mk, and if someone is pretending to be from AD Poshta na Severna Makedonija), most likely it is a fraud.
If there is any link in the message that should be followed, it should be checked in detail where it leads to the URL on the Internet browser (in the previously mentioned fraud, it leads to posta-mk.ddns.net, not to posta.com.mk). You should not click on the link, you just need to place the cursor over it, after which the URL will be displayed. If it differs from the official one, it is probably a fraud. This is especially important because by clicking on the link, you may be taken to a malicious website that will install malware on the device, and you may become a victim of multiple types of fraud.
What to do if this happened to me?
If you receive information that you have been defrauded and funds have been stolen, the first thing you need to do is immediately block the payment card used for the transaction. This can be done through the call center of the payment card issuing bank, or via internet banking or mobile banking in some banks that provide this possibility.
The next step is to report the fraud with all the details to the nearest branch office of the bank issuing the payment card and fill in the so-called “cardholder letter”, which is a statement that the transaction was not made by you. At the same time, this statement serves as a refund request, and the payment card issuing bank forwards it to the company owner of the payment scheme (most often VISA or MasterCard). After this, the companies will launch an investigation and, based on the emerging conclusions, funds can be recovered.
The final step is to submit a card re-issue request to the card-issuing bank.
Digitalization of society and increased use of services on smart devices or computers both by companies and citizens bring about increased exposure and vulnerability to computer crimes. While most companies have established risk reduction processes by educating the staff and improving their protection systems, citizens are paid very little attention. To be able to move ahead with certainty, public awareness of the risk existence must be raised and protection against this threat must be integrated into the education system to ensure that young generations are prepared for the future.
*Criminal offenses – computer crime, source: data.gov.mk