Navigating Cyber Fraud After a Natural Disaster
- Written by Morey Haber, Chief Security Advisor at BeyondTrust
As Australia enters another long, hot and potentially destructive summer, businesses and residents are preparing for the natural disasters synonymous with the season: storms, cyclones, and bushfires.
In disaster-prone regions, thorough preparation and planning are critical for mitigating risks and ensuring swift recovery when disaster strikes. However, while physical threats often dominate the headlines, a digital menace lurks in the background: cyber fraud.
Cybercriminals exploit the chaos that disasters leave behind, targeting vulnerable businesses and individuals with scams disguised as relief efforts or essential services. In the face of such challenges, understanding their tactics and implementing robust countermeasures can protect businesses and individuals from becoming victims of these schemes.
The rising threat of post-disaster cybercrime
In the aftermath of natural disasters, cybercriminals use sophisticated tactics to capitalise on the urgency and emotional turmoil that disasters create. These scams often appear highly credible, preying on victims’ need for immediate assistance. Common schemes include the following:
-
Phishing emails disguised as relief efforts:
One of the most common methods cybercriminals use is phishing emails. Scammers often impersonate government agencies, disaster relief organisations, or local authorities, sending emails that promise quick financial aid or assistance. Victims are asked to provide sensitive information, such as Medicare numbers or bank account details, to expedite their claims. Clicking on fraudulent links within these emails can lead to malware installation, data theft, or exposure to ransomware.
For business owners, the pressure to resume operations quickly can cloud judgment, making them particularly vulnerable. The best defence is verification: cross-check URLs, confirm the legitimacy of emails through official websites, and avoid clicking on links from unsolicited messages. -
SMS scams offering “urgent” repairs:
Text message scams are another prevalent post-disaster tactic. Scammers impersonate contractors, insurance agents, or government representatives, offering quick repairs or expedited claim processing. These messages often create a sense of urgency, pushing victims to act without proper verification.
These scams might ask for upfront deposits, personal information, or even physical access to properties. To counteract this, businesses should avoid engaging with unsolicited text messages and always verify the credentials of contractors and agents through reliable channels. -
Charity fraud and crowdfunding scams:
The aftermath of disasters brings out the best in communities, with charities and individuals rallying to provide support. Unfortunately, it also brings out opportunistic scammers who exploit the generosity of others. Businesses may receive emails, texts, or social media messages promoting fraudulent charities or crowdfunding campaigns.
To protect against such fraud, businesses should only donate through verified platforms, carefully scrutinise web addresses for anomalies, and be wary of payment requests through unconventional means like cryptocurrency or gift cards. -
Fraudulent insurance claims processes:
Insurance scams are another common tactic. Fraudsters impersonate insurers, sending emails or text messages that mimic official communication. These messages may include realistic claim numbers or company logos, urging recipients to update payment information or upload photos of damage through bogus portals.
These schemes aim to steal sensitive data or siphon funds through fake payment links. To avoid such scams, bypass the links entirely and contact your insurer directly using known contact details.
Proactive measures to safeguard you and your business
While the aftermath of a natural disaster is a challenging time, individuals and businesses can take proactive steps to reduce their exposure to cybercrime. Robust cybersecurity practices and awareness can act as a shield, protecting both finances and data. It is important to take steps such as:
-
Scrutinise communications: Always exercise caution when dealing with unsolicited messages or emails, especially those requesting sensitive information or immediate action. Look for subtle signs of fraud, such as spelling errors or inconsistent branding.
-
Verify before acting: Avoid clicking on links or attachments in unsolicited communications. Instead, use official contact methods to confirm the legitimacy of the sender.
-
Monitor financial accounts: Vigilance is critical in the weeks following a disaster. Regularly check bank statements and credit reports to identify any unauthorised transactions promptly. Early detection can minimise financial damage and provide a trail for resolution.
-
Educate employees and stakeholders: A well-informed team is a business’s best defence against cybercrime. Conduct training sessions to familiarise employees with common scams and encourage a culture of caution when dealing with external communications.
-
Implement cybersecurity measures: Beyond vigilance, investing in cybersecurity infrastructure can offer additional protection. Install robust anti-malware software, enable two-factor authentication on accounts, and back up data to secure, remote locations. These measures ensure that even if a breach occurs, damage is minimised.
Building digital resilience alongside physical recovery
Natural disasters are an unfortunate reality for many Australians. While communities focus on physical rebuilding, it’s vital to recognise that the digital landscape also demands attention. Cybercriminals thrive on moments of crisis, turning recovery efforts into opportunities for exploitation.
By staying informed, vigilant, and proactive, businesses can navigate the challenging aftermath of disasters without succumbing to cyber fraud. Preparation is not only about physical safety but also about fortifying digital defences. In doing so, businesses can rebuild stronger, more secure, and better prepared for the challenges of the future.
