Current:Home > StocksEmail fraud poses challenges for consumers and companies during the holiday season -Wealth Legacy Solutions
Email fraud poses challenges for consumers and companies during the holiday season
View
Date:2025-04-13 23:04:48
With the holiday season upon us, beware "gifts" nobody wants: email fraud and cyberattacks.
Cybercriminals take advantage of consumers' attention on a particular subject — like, for example, Black Friday or Cyber Monday sales — to run scams, or they use the distraction of the moment to cause disruption.
They'll slip into the rush of urgent emails offering limited-time deals, hoping to disguise themselves as legitimate retailers. With the National Retail Federation predicting a record high in spending over the holidays in 2023, cybersecurity is especially important.
Vulnerable email is in part to blame
Cybercrime remains lucrative in part because of the inherent insecurity of email, a form of communication that's typically not encrypted or signed by a verified sender or recipient.
Advancements have been made to help improve that security. Some email providers offer encryption. And if the email looks questionable, the recipient can always open a browser and search for a deal rather than clicking on a link to fact-check whether it's real. Plus, there's a tool called DMARC, the domain-based message authentication, reporting and conformance protocol. It's a long-established best practice to help companies prove who they say they are over email.
But according to new research from the cybersecurity firm Proofpoint, 52% of the top 50 U.S. retailers ranked by the National Retail Federation are not fully compliant with that protocol. Essentially, that means they're not taking steps to block fraudulent emails or protect their websites' domain names.
Proofpoint also noted that only 14% of those companies direct potentially fraudulent emails linked to their brands into quarantine, or the recipient's spam or junk folder.
"So one way to look at this is like Gmail on Black Friday or Cyber Monday. It's kind of like JFK airport over Thanksgiving," says Robert Holmes, who leads email fraud detection efforts at Proofpoint. "Imagine you were at JFK airport on one of those days with a lot of people coming and going, and imagine a world where that airport didn't check IDs or didn't check passports. That would be a bad world. Lots of nefarious activity would happen on busy days in particular."
In many cases, consumers are encouraged to protect themselves in cyberspace by, for example, watching out for phishing emails or not clicking on sketchy links.
However, Holmes argues, more of the burden should fall on companies to implement a layer of protection for all their customers. "So the thing about good security is, it should be invisible to Joe Public," he says.
There's a push to adopt DMARC — or face the consequences
For years, governments have encouraged the adoption of DMARC but haven't required it. With partial adoption, it's difficult for the average consumer to know whether a retailer is verified through DMARC when browsing through marketing emails.
However, that might be beginning to change. Over the years, Google, for example, rewarded companies that complied with DMARC by offering them verification badges that consumers could see. Major email providers have taken various steps to push retailers into adoption.
Now, Google and Yahoo will be taking that a step further by requiring companies to participate by February 2024. If companies fail to implement the protocol, their emails will be more likely to be flagged as spam or blocked entirely.
"In October, Gmail announced new requirements for bulk senders that will make users' inboxes safer and less spammy," said Neil Kumaran, the group product manager at Gmail's security and trust team, in a statement to NPR. "These are straightforward requirements based on open standards, are in line with established industry best practices, and reflect basic email hygiene."
That's an encouraging step toward improving email security, Holmes says.
His only concern is that companies might fail to come into compliance by February.
For larger retailers with a complex web of outside suppliers and contractors, it will be a little more challenging to fully comply, Holmes says. The DMARC protocol factors in every third party authorized to send emails on one entity's behalf, ranging from automated systems that deliver newsletters, like Mailchimp, to those that send updates on doctor's appointments or flight time changes.
"I think the consequences of getting this wrong are severe," Holmes says. "Legitimate email gets blocked. ... People will miss appointments. People will miss flights. People won't make payment."
Of course, those consequences aren't a guarantee — it's just more likely that potentially legitimate email that doesn't comply with DMARC will get blocked. And major email providers have been taking incremental steps toward pushing companies into compliance with DMARC over several years, Holmes says. This decision to require DMARC compliance isn't coming out of the blue.
"Many senders already meet these requirements, and for those who are still working on it, we're sharing clear guidance to help," said Google's Kumaran. "Doing so is crucial to close loopholes we know attackers are targeting, and will help make email safer for everyone."
veryGood! (67495)
Related
- Taylor Swift Eras Archive site launches on singer's 35th birthday. What is it?
- A pediatrician's view on child poverty rates: 'I need policymakers to do their job'
- Philadelphia native and Eagles RB D'Andre Swift has career game vs. Vikings
- 3 dead after possible hostage situation in Sacramento, including the shooter
- Whoopi Goldberg is delightfully vile as Miss Hannigan in ‘Annie’ stage return
- The teen mental health crisis is now urgent: Dr. Lisa Damour on 5 Things podcast
- Republican presidential hopefuls generally overlook New Hampshire in effort to blunt Trump in Iowa
- 2023 Maui Invitational will be moved to Honolulu, keeping tournament in Hawaii
- B.A. Parker is learning the banjo
- Watch: TSA agents in Miami appear to steal passenger items; what they're accused of taking
Ranking
- What to know about Tuesday’s US House primaries to replace Matt Gaetz and Mike Waltz
- New York City mayor gives Sean ‘Diddy’ Combs a key to the city during a ceremony in Times Square
- EV battery plant workers fight for better rights, pay
- Sienna Miller rocks two-piece, caresses baby bump at London Fashion Week
- FACT FOCUS: Inspector general’s Jan. 6 report misrepresented as proof of FBI setup
- US Soccer getting new digs with announcement of national team training center in Atlanta
- Lawsuit alleges sexual assault during Virginia Military Institute overnight open house
- Jury finds officer not liable in civil trial over shooting death
Recommendation
US wholesale inflation accelerated in November in sign that some price pressures remain elevated
Greece wins new credit rating boost that stops short of restoring Greek bonds to investment grade
Aaron Rodgers says he's starting 'road to recovery' after Achilles surgery went 'great'
Biden announces more Iran sanctions on anniversary of Mahsa Amini death
Meta releases AI model to enhance Metaverse experience
West Virginia University gives final approval to academic program, faculty cuts
How much does an average UAW autoworker make—and how much do Big Three CEOs get paid?
Man pleads guilty in deadly Jeep attack on Reno homeless center