Continued on page 22 The Cost of Cybercrime The likelihood that a business will experience financial damage after a cybercrime attack is rising quickly. The average cost of downtime from a ransomware attack has doubled over the past year to $274,200.4 The average downtime is now 19 days, a three-fold increase from 2019.2 Direct economic losses are compounded by lost revenues from operational disruptions, brand reputation damage, and decreased customer loyalty. A 2021 IBM/Ponemon Institute survey found that a data breach costs U.S. businesses an average of $180 for each accessed/stolen record containing customer PII.3 For dealerships with thousands of records, the damage can add up quickly, not to mention the impact on customer relationships. A Ping Identity consumer attitude survey reported that 25% of respondents would stop using a business after a data breach.6 The potential for cybercrime to inflict direct losses, reputational damage, and customer loss highlights the importance of making data security and cyberfraud defense a priority. A salesperson responded to a phishing email, opening a malicious file with ransomware and providing cybercriminals access to that computer. The salesperson did not suspect an intrusion. Once behind the firewall, the hackers were able to access the dealership’s entire system and servers. The hackers used the compromised computer to probe the network, looking for vulnerabilities to lock up the dealership’s computer operations. The criminals were able to shut down the dealership’s systems for over a week – asking for payment in bitcoin to relinquish control of the systems. All of the dealership’s servers and emails and one-third of their 300 computers were inoperable. They chose not to pay the ransom, but instead took the next month to rebuild their systems completely. How could this cyberattack have been prevented? • Through employee education on the hazards of downloading unsubstantiated files or clicking on suspicious links; • With proper web filters and controls to block hazardous links; or • By implementing fraud software to quickly find, mitigate, and recover information compromised by fraud and ransomware attacks. Limiting Primary Fraud Threats When it comes time to address criminal activity targeting payments, banking transactions, customer data, communications, and computer systems, it is important to analyze both non-cyber and cyberfraud. Equally important is identifying the sources of threats – internal and external – and dealing with each accordingly. Simple protection measures along with insurance for business crime, cybercrime, or data breaches can dampen losses. Measures to limit risks include: Employee education is the top method for lowering the risk of fraud in general, and cyberfraud in particular. A company culture that values overall fraud prevention sends a powerful signal to employees. Employee education about fraud awareness is one of the best ways to get started. Fraud barriers include: • Clearly defined fraud prevention roles and responsibilities for you and your employees • Separation of duties, checks and balances, and multifactor authorizations for funds transfers • Secured computers with password protection, changed periodically • Restricted user account access to individual owners with no shared access • Web filters and controls that block clicks on potentially fraudulent links Check and wire fraud are the top two payment fraud threats for any business. Sixty-six percent of companies reported that check payments were subject to fraud, and 39% were victims of wire fraud attempts.1 Dealership payment volumes – both paper and electronic – make an attractive target for fraud. Implementing a few simple, inexpensive processes can protect your dealership. • Use positive pay services. You’ll be able to verify the authenticity of checks by looking over the issue date, check number, amount, and payee name to catch check fraud. • Protect check stock with dual authorization before use. • Authentication is further enforced through online banking platforms which require additional authentication for wire transfers through assigned user ID and password logins, requestor authentication, and dual approvals. 21
RkJQdWJsaXNoZXIy ODQxMjUw