Corporate identity theft

Identity theft is an increasingly common cybercriminal practice. It can lead to huge financial losses for a company. There are a few ways to protect yourself, but hackers are constantly updating their techniques.

What does identity theft look like?

Identity theft is defined as the use of personally identifiable information by a third party without your consent. Identity theft can be used to deceive a victim. In a company, the impersonator may, for example, pretend to be the CEO to an employee (CEO scam). He may induce the latter to transfer funds to an account for a supposedly important project. The victim, believing he’s dealing with the real CEO, will carry out the transaction without the slightest doubt – this is what’s known as thepresident scam.

This type of usurpation can be achieved by using fraudulent e-mail addresses. This method fools the victim into believing that the e-mail comes from a trusted source. Email spoofing is also part of the phishing or spearphishing process. Phishing is a scam technique that forces you to reveal your important credentials (password, credit card number, etc.).

With e-mail programs, when you receive an e-mail, only the sender’s name is displayed. By borrowing the name of a high-ranking person in a company, the hacker can easily fool a few employees. If they’re busy, they won’t check the suspicious email address and will think they’re dealing with their superior. The pirate can then ask them to make a transfer to an account belonging to him.

Another clever method is to use a mail name close to the original (known as the nearest neighbor method). If, for example, your CEO’s email address is “paul@gmail.com”, the hacker can use the address “pauI@gmail.com”. The difference between these two addresses is that the pirate’s uses a capital “i” instead of an “l”.

How can I protect myself?

The first thing to do to protect yourself from this type of scam is to train and sensitize your employees to be more cautious. Even if some usurpations are difficult to distinguish, it is possible to prevent them from causing harm. A clear policy on the money transfer process, for example, can reduce the risk of CEO fraud.

When it comes to fraudulent domain names, companies need to train their employees to be wary. All domain names belonging to the company must be known. It’s even possible for a company to purchase all domain names that are similar or close to the one it uses, or to set up an alert system for the purchase of similar domains: cybersquatting / typosquatting.

If an e-mail requires you to visit a well-known site, it’s best to type the site address into your browser. As for attachments, it’s best not to open them unless the e-mail comes from a known source.

To secure your actions, you also need to use up-to-date antivirus software and other protection systems. Some of these professional email security devices, such as Altospam, are able to detect the use of typosquatting emails. They can also analyze the structure of an e-mail and block any attempt to scam the president.

What recourse is there in the event of usurpation?

If identity theft is detected, it’s important to collect evidence of the offence (screenshots, supporting documents, etc.). Next, it’s essential to contact the sites where the usurpation took place, so that the relevant departments can take the necessary steps.

The best way to save time if this happens to you is to pre-complain online at https://www.pre-plainte-en-ligne.gouv.fr/. It will only have legal force once it has been signed by the authorities. You will then have to file your complaint with the appropriate authorities. Your complaint can be lodged with a police station, a gendarmerie brigade or with the public prosecutor. They can help you solve the problem. They will conduct an investigation, but if the criminal is not identified, your case will be closed. You can also report a scam on the PHAROS platform: https://www.internet-signalement.gouv.fr/

If you are a victim of the President scam and have already made a transfer, contact your bank as soon as possible so that they can try to return the funds.

If your identity has been stolen, the first step is to file a complaint with the bank if the identity thief has carried out transactions in your name. Depending on the actions taken by the usurper, the victim may find himself or herself registered with the Banque de France. It will then be necessary to check whether or not the file has been registered.