Handbook / Running the week

Phishing scams targeting freelancers and small businesses

Freelancers and small businesses are attractive targets for phishing. You handle client payments, receive invoices from strangers, manage clients' accounts and often do not have an IT department to catch suspicious messages. One successful phishing message can empty an account, lock you out of your email or expose client data.

What phishing is

CISA, the U.S. Cybersecurity and Infrastructure Security Agency, describes phishing as attempts by criminals to get you to open harmful links, emails or attachments that could request your personal information or infect your devices. It can arrive by email, text, social media direct message or phone, and is designed to look like it comes from a trusted source.

Common signs

CISA lists common signs of phishing:

• urgent or emotionally appealing language, especially messages that claim dire consequences for not responding immediately
• requests to send personal and financial information
• untrusted shortened URLs
• incorrect email addresses or links, with slight misspellings of real brands

CISA also notes that poor grammar and misspellings used to be a common sign, but some phishing messages now have perfect grammar and spelling, so watch for the other signs.

Scams aimed at small businesses

• Fake invoices: bills for services you never ordered, often for small amounts that might be paid without question.
• Payment change requests: messages that appear to come from a client or supplier saying their bank details have changed.
• Account alerts: fake warnings that your email, bank, payment processor, domain or social account will be suspended.
• Fake clients: "new projects" that require you to open an attachment, log in through a link or pay a fee to start.
• Overpayment scams: a client pays too much and asks you to refund the difference before their payment bounces.
• Fake official notices: messages that imitate government agencies, tax authorities or registration offices.

Recognise, resist, report, delete

CISA's simple approach:

1. Recognise the signs above.
2. Resist the temptation to click links or attachments that may be trying to access your information.
3. Report the message, using the report options in your email or messaging app.
4. Delete it, without replying or clicking any link, including unsubscribe links.

Verify through a trusted channel

CISA advises that if a message might be real, you should not click links or call numbers in it; instead, contact the company or person directly using a method you find yourself, such as their official website. For your business, make this a firm rule:

• confirm any change to payment details by calling a number you already have on file
• log in to accounts by typing the address or using a saved bookmark, not through email links
• confirm unexpected requests from clients through your usual contact

The guide to ACH payments covers safe payment habits.

Protect your accounts

• Multifactor authentication: turn it on for email, banking, payment, domain and social accounts. CISA's secure our world guidance recommends it.
• Password manager: use long, unique passwords for every account, as CISA recommends.
• Updates: keep devices, browsers and apps updated.
• Separate accounts: limit who has access to business banking and admin accounts.

Protect client accounts

If you manage clients' websites, ads or social accounts, you are a route into their systems. Use role-based access where possible, never share passwords by email and remove access you no longer need. See social media management business.

Social engineering

CISA's guidance on social engineering advises being suspicious of unsolicited calls, visits or messages asking about employees or internal information, verifying someone's identity directly with their company, and not revealing personal or financial information unless you are certain of a person's authority to have it.

If you clicked

Act quickly:

• disconnect the affected device from the network if malware may be involved
• change passwords from a different, trusted device, starting with email
• turn on multifactor authentication where it is not already on
• contact your bank or payment provider immediately if you shared payment details or sent money
• tell affected clients if their information may be exposed
• restore files from backups if needed; see data backup

Cyber insurance may help with some costs of an incident, depending on the policy.

Build habits

Slow down before acting on any message about money, passwords or urgent problems. A short pause and a call to a known number stop most phishing attempts.

Learn the signs CISA lists, resist clicking, report and delete suspicious messages, verify payment changes and account alerts through trusted channels, use multifactor authentication and a password manager, and act quickly if you are caught.