Security Sales & Integration September 2022 - 8

INDUSTRY PULSE
IN DEPTH
The time is now to protect
your company and
your clients from cybersecurity scams.
The sophistication of hackers and their
schemes is growing more elaborate every
day, and every moment that integrators
wait to secure their own business and
their customers is time wasted.
Consider this systems integrator, who
graciously shared his cautionary tale of
cybersecurity woe with SSI sister publication
CE Pro so others will learn from it.
Like many cybersecurity scams, this
one began back when the integrator got
a phishing email that asked for his Microsoft
Outlook365 password back in May.
" I get phishing emails all the time, but
I remember this particular one because I
didn't even know what my Outlook password
was. I had to ask my wife, " he recalls.
After inputting his password, he was
migrated to a web page that wasn't even
related to the original subject.
" I didn't think anything about it at the
time. I just closed the page and forgot
about it, " he remembers.
Over the next several weeks, he was
engaged in some detailed back-and-forth
emails with a local homebuilder regarding
signing a contract for a $115,000
project. It was a brand-new relationship
and one he was very excited about. The
equipment deposit was to be for $62,000.
The builder said he cut checks on the first
and 16th of each month so the deposit
would be forthcoming.
" It was about one week before Snap
prices, so I
One was due to raise
its
emailed the builder that we needed to get
it done this week to take advantage of the
lower equipment costs, " he recalls.
Knowing that $62,000 deposit was
on the way in a few days, the integrator
purchased all the equipment for the job
(something he normally never does before
he has the deposit in hand).
8
NEWS ANALYSIS RESEARCH PEOPLE
Hard Lesson in Cybersecurity Scams Hits
Home for Dealer by Jason Knott
The integrator's IT team determined that the sophisticated hacker had gained
access to the MS Outlook email on a Saturday, a day when any activity is less likely
to be noticed.
A few days after the first of the month
when the check had not arrived, the integrator
sent a courtesy email to check
in with the builder. No response. So, a
few days later he called the builder to ask
about the status of the deposit. That was
when the builder informed him he had
wired the money to his account per the
" instructions in his latest email. "
" My heart just sank, " recalls the veteran
integrator. " I had not sent him any emails
asking for a wire transfer. "
Peeling back the onion of discovery on
how it happened, the integrator's IT team
determined that the sophisticated hacker
(eventually determined to be based
in Sweden) had gained access to the MS
Outlook email on a Saturday, a day when
any activity is less likely to be noticed.
Once inside the dealer's email, the
swindler had written code that automatically
moved any correspondence between
the builder and the integration company
into a hidden folder in the dealer's MS
Outlook. That is why he didn't see any
responses from the builder to his emails
after a certain date.
Inside the hidden Outlook folder, he
later discovered all the correspondence
that had taken place between the hackSecurity
Sales & Integration SEPTEMBER 2022
er and the builder. The thief had found
both an old W9 and an old subcontractor
form in his email and sent those
documents to the builder just to make it
seem like the transaction was legit. Later,
the hacker reached out to the builder
asking if he could send the money via a
wire transfer instead of writing a check.
It was all very meticulous.
When the dust had settled on the scam,
the homebuilder was out $62,000 and the
integrator was out the money he plunked
down for the equipment. The bank that
handled the wire transfer won't put a
" fraud alert " on the account, according
to the integrator. Both he and the builder
are in discussions with their insurance
companies regarding any fraud insurance
they might have in their policies.
" You hear about stuff like this, but
think it is the kind of thing that happens
to someone else. I am totally embarrassed, "
says the dealer, who is resigned to
the fact that any future relationship with
that builder is in jeopardy. " A $115,000
job is a big deal for us. We are only a $1.2
million company. "
Jason Knott is Editor-in-Chief of SSI
sister publication CE Pro.
securitysales.com
WEERAPAT1003/STOCK.ADOBE.COM
http://www.securitysales.com
Security Sales & Integration September 2022

Table of Contents for the Digital Edition of Security Sales & Integration September 2022
