Before you sign off for the holidays, take these steps to safeguard your business and client information:

• Lock up or securely dispose of all physical files. Use locked storage for documents you need to keep and shred any you no longer require.
• Keep laptops, tablets and phones out of sight and secure.
• Sign out of all accounts and devices. Leaving sessions open increases the risk of unauthorized access.
• Update your software. Outdated systems are easy targets for cyber criminals. Enable automatic updates to simplify the process.
• Back up your files regularly. Use a physical device (such as an external hard drive) or cloud storage to protect against data loss, theft and malware.
• Remove user permissions for staff who have left or no longer require access. This includes shared accounts. Unauthorised access by former employees is a common cause of identity security or fraud issues for businesses.

Source: ATO

The post Simple Steps to Safeguard Your Office During the Festive Break appeared first on Mark Accountants.

Step 1: Install updates for your devices and software

Regular updates ensure you have the latest security in place which can help prevent cyber criminals from hacking your devices. You should also make sure you are downloading authorised and legitimate programs.

Check your devices for updates, and turn on automatic updates so that future updates are made straight away when charging and connected to Wi-Fi.

Step 2: Implement multi-factor authentication

Multi-factor authentication (MFA) is a security measure that requires at least 2 proofs of identity to grant access. Businesses as well as individuals should implement MFA wherever possible. MFA options can include a physical token, authenticator app, email or SMS.

Learn how to turn on MFA for your accounts.

Step 3: Regularly back up your files

Backing up copies of your files to an external device or the cloud means you can restore your files if something goes wrong. It is a precautionary measure that can help to avoid costly data recovery.

Setting up and performing regular backups in your system or application settings can provide you peace of mind that your devices are backed up on a regular basis.

Step 4: Change your passwords to passphrases

Using passphrases can boost the security of your accounts and make it harder for cyber criminals to access your information. Passphrases use 4 or more random words and can include symbols, capitals and numbers. A password manager can help you generate or store passphrases.

Improving your cyber security is easy, to learn more the ACSC offers practical advice and information on ways to protect yourself online.

Source: ATO

The post Be Cyber Wise, Don’t Compromise appeared first on Mark Accountants.

Scam advice

Be wary of emails, phone calls and text messages claiming to be from the ATO.

If you think a phone call, SMS, voicemail, email or interaction on social media claiming to be from the ATO is not genuine, do not engage with it. You should either:

• phone the ATO on 1800 008 540
• go to Verify or report a scam to see how to spot and report a scam.

August – 2023 taxtime SMS and email scams

This tax time, the ATO are receiving an increased number of reports about several ATO impersonation SMS and email scams.

These scams encourage people to click on a link that directs them to fake myGov sign in pages designed to steal their username and password.

Scammers use many different phrases to try and trick recipients into opening these links. These include (but are not limited to):

• ‘You are due to receive an ATO Direct refund’
• ‘You have an ATO notification’
• ‘You need to update your details to allow your Tax return to be processed’
• ‘We need to verify your incoming tax deposit’
• ‘ATO Refund failed due to incorrect BSB/Account number’
• ‘Due to receive a refund, click here to receive a rebate’

The images below are examples of the format this scam can take.

Do not open any links or provide the information requested.

We won’t send you an SMS or email with a link to log on to online services. They should be accessed directly by typing ato.gov.au or my.gov.au into your browser.

While we may use SMS or email to ask you to contact us, we will never ask you to return personal information through these channels.

Report any suspicious contact claiming to be from the ATO to ReportScams@ato.gov.au.

January 2023 – ATO social media impersonation accounts scam

The ATO are seeing an increase in fake social media accounts impersonating the ATO, ATO employees and senior executive staff across Facebook, Twitter, TikTok, Instagram and other platforms.

These fake accounts ask users that interact with the ATO to send them a direct message so they can help with their enquiry.

The people behind these fake accounts are trying to steal your personal information, including phone numbers, email addresses and bank account information.

The ATO’s only official accounts are on Facebook, Twitter and LinkedIn.

The best way to verify that it’s really the ATO is to:

• check how many people follow the account. The ATO’s verified Facebook and LinkedIn accounts have over 200,000 followers, and their Twitter account has over 65,000 followers
• check activity on the accounts. The ATO’s social media channels have been operating for around 10 years – if it’s a newly created account, or only has a few posts, it’s not them
• look for the grey tick next to our username (@ato_gov_au) on Twitter and the blue tick next to the ATO’s name (Australian Taxation Office) on Facebook
• make sure any email addresses provided to you end with ‘.gov.au’.

The images below show examples of what impersonation accounts might look like.

If you’re approached by an impersonation account, do not engage with them. Take a screenshot of the account, email the information to ReportEmailFraud@ato.gov.au and block the account through the social media platform’s reporting function.

Source: ATO

The post Scam Alerts appeared first on Mark Accountants.

Australians lost more than $20 million to bank impersonation scams in 2022, according to Scamwatch, run by the Australian Competition and Consumer Commission (ACCC). Last year the watchdog website received 14,603 reports of scammers impersonating bank communications with legitimate-looking text messages and phone calls.

It was part of a bumper year for scammers, with $169 million reported lost in Australia to all text and phone scams, up $59 million from 2021 (a 54% increase), according to the ACCC.

Scammers use sophisticated social engineering techniques to succeed in stealing hundreds of thousands of dollars from busy workers. They invest a significant amount of time in research and reconnaissance so they can be as convincing as possible– down to making sure they have the right hold music for your bank.

A scammer is likely to know your bank’s procedure, the questions they will ask, and how to sound like your bank. They are good at what they do.

How do bank impersonators do it?

In a bank impersonation scam, you receive a phone call or SMS that appears to be from your bank, often the security team.

Some common scenarios scammers use include:

• you’ve been pre-approved for a loan (that you never applied for)
• your online account has been compromised 
• an irregular payment has been detected.

When you click on the link or call the number, the scammer outlines a situation that requires immediate action – often it’s that your account has been hacked, and you need to shift your money to a ‘safe’ account or PayID the scammer supplies. Or they’ll try to coax access details for your account from you. You’ll be told they’re ‘here to help.’ But they’re not.

Think you’re too smart for a scam? Think again

CommBank has received a number of calls from business customers who have realised they have been scammed too late. Although customers may alert the bank straight away, the money is often already moved into cryptocurrency and beyond recovery. 

For example, a sole trader customer of CommBank received a call from a man with a British accent claiming to be from the security team.

He advised her that a suspicious payment had been made from her account, and that he needed her to help him access her facility so he could help. As she couldn’t log in when she tried, the customer believed the caller. The victim had provided the caller with enough information for him to already reset the password and when she tried to log in, her password no longer worked.

The customer provided the scammer with the answers to her security questions and generated three e-tokens over the course of the call. As the scammer was able to access the CommBiz facility the client lost $700,000 from their business account.

No business is immune to scams and fraud

The average cost per cybercrime report rose to over $39,000 for small business, $88,000 for medium business, and over $62,000 for large business, according to the ACSC. The reported losses from phone scams in 2022 totalled $141 million.

Scammers succeed because we lead busy lives, and many of us multi-task throughout the day. And they don’t just target owners – they target employees too. All a scammer needs is for the target’s mind to not be 100% focussed on the present. They don’t want you or your employees to have time to think, which is why phones are the second-most popular (29%) way scammers contact their targets. A scammer wants their target off-balance. They don’t need them to be high up in the business to use them to steal.

No business is safe from fraud. Any business, regardless of size or industry, can be successfully targeted. Key to thwarting these attempts is noticing if there is an unusual, unexpected sense of urgency, or something else doesn’t feel right. Remember: stop, check, and reject.

You are the first and last line of defence

Businesses should investigate potential vulnerabilities and implement best practice procedures, such as not having just one person responsible for creating and approving a payment. It’s vital that every employee knows to never give out e-tokens, passwords or answers to secret questions. 

Staff need to understand that tokens and e-tokens are as big a safeguard to a business’s finances as passwords or two-factor authentication and should never be given to another person. 

A bank will never ask you for this information. Your bank might ask for identifying information, like your name or date of birth, but they will never ask you what your PIN is, what your token is, or what your passwords are.

Whenever you have any doubt, hang up the phone and contact your bank directly on a number that you know – one that’s in your phone or on Google.

Source: CommBank

The post When Bank Impersonators Go Phishing appeared first on Mark Accountants.

As Australia approaches the EOFY, brokers, individuals, organisations and their employees should stay alert to phishing, smishing (SMS phishing) and vishing (phone call phishing) scams. Cyber criminals attempt to take advantage of this time of year with sophisticated tax-related impersonation scams, namely those appearing to originate from the Australian Tax Office (ATO).

With the Australian Competition & Consumer Commission (ACCC) revealing over $3.1 billion combined losses reported due to scams in 2022, there’s no time like the present for organisations to check their security posture.

Targets: Businesses and employees.
Method: Often through the sending of targeted emails that spoof legitimate people and organisations to request payment transfers or changing of invoice details.

Target: Individuals and businesses.
Method: Scammers may impersonate a business or its employees, requesting payment be directed to a fraudulent account.

Target: Individuals and businesses.
Method: Fraudulent emails, websites and social media pop-ups may be used by criminals to trick victims into thinking they are donating to legitimate charities.

Top Tips to Help Protect Yourself this EOFY

• Seek confirmation if you receive a request via email to change payment information by third parties (such as, a landlord or supplier). Always confirm by contacting the third party directly by using contact information that you know is genuine, and not contained within the suspicious email in question.
• Turn on multi-factor authentication for all essential services such as email, bank, social media accounts and any databases holding you customer information.
• Avoid clicking links in emails or pop-ups, instead access websites directly through your web browser.
• Remember if something seems too good to be true, it usually is.

Source: ANZ

The post Be Cyber Safe This EOFY appeared first on Mark Accountants.

Source: Telstra

The post How To Help Protect Your Business appeared first on Mark Accountants.

They typically request a change in bank account details for a deposit, wages or invoice payment. Victims then unknowingly send money to the cybercriminal.

These fraudulent emails may come from hacked email accounts, or cybercriminals might register domain names that are similar to legitimate companies.

You can protect yourself, and the reputation of your business, by taking a few simple steps:

• Verify payment details. If you hold sensitive financial records, ensure you confirm the identity of anyone who requests changes to their information.
• Alert your staff. Train your employees to identify suspicious requests or emails that may link to fake websites built to capture passwords.
• Secure your email account. Use multi-factor authentication or, if this is not possible, a strong unique passphrase that would be difficult to hack.

Source: ATO

The post Protect Your Business From Cyber Scams appeared first on Mark Accountants.