Email-based identity deception – sometimes referred to as email fraud or impostor email – is one of today’s greatest cyber threats. These highly targeted attacks are socially engineered to trick people into sending money and other valuable information on the criminal’s behalf.
Because email fraud is widespread and impactful, Proofpoint regularly conducts research into this threat landscape. Here are some of our findings for email fraud in Australia for 2018.
Attackers are targeting more organisations in Australia – and more often. Impostor email attacks increased 112% from Q1 2018 to Q4.
All industries were targeted, and we found no correlation between the size of the company and the frequency with which they were targeted by impostor email. Throughout 2018, the top 4 industries targeted in Australia were financial services, real estate, construction, and mining.
When looking at the data for Australia, we saw consistency with the rest of the world when it came to what the fraudsters were trying to steal: money. About 61% of all impostor emails in 2018 were subject categories that included “payment” (about 29% of total), “urgent” (about 17%), and “request” (about 15%).
One reason it can be difficult to stop email fraud is that criminals use various identity deception tactics to exploit people, including display name spoofing (e.g., “John Smith”), domain spoofing (e.g., yourcompany.com), and lookalike domains (e.g., y0urcornpany.com). In 2018, nearly 83% of the organisations targeted by impostor email attacks included at least one domain spoofing attack, and 27% of the organisations targeted included at least one lookalike domain.
Domain spoofing attacks – where the impostor email uses an organisation’s exact domain name – can be prevented by fully deploying email authentication. The standard for email authentication is DMARC authentication. About 47% of the Global 2,000 companies based in Australia (sample size: 38) have adopted DMARC authentication at some level. For context, only about 32% of the organisations included in the Global 2,000 have adopted DMARC authentication at any level.
On a global level, email fraud continues to reach new levels of impact. According to the FBI, business email compromise (BEC) – one form of email fraud – cost organisations around the world more than $1.2 billion (USD) last year. That’s a 78% year-over-year increase.
To learn more about how to protect your employees, business partners, and customers against email fraud, please visit: https://www.proofpoint.com/au/solutions/email-fraud.