The digital footprint in the business environment: a key factor in fraud prevention

The exposure of information on the network, as well as every online interaction and action, leaves a trail that forms a digital footprint and that is relevant for both individual users and business environments. In the case of companies, regardless of their sector and size, it is essential to identify and protect the information exposed to preserve its integrity and prevent possible security attacks.

The digital footprint study is not limited to the information that the company decides to make public, such as its website, social networks or official images, but covers any type of data that can be collected in order to obtain more information about the company. Such data can include employee and customer comments and images on social networks, financial and business information, metadata, operating systems and corporate tools used, vulnerabilities, or unprotected information in repositories.

The digital footprint not only affects the company's reputation, as it is closely linked to its brand and digital identity but can also be analyzed and used by threat actors for malicious purposes. The following are some examples of this:

• CEO fraud: this fraud aims to trick employees who have access to the company's financial resources into transferring money from the company's bank account or paying a false invoice, for example. To commit this fraud requires, among other things, extensive knowledge of how the company works, the management and middle management positions and the types of corporate communications.
  
  A well-known case of this type of fraud occurred earlier this year at a Hong Kong multinational. The company was the victim of a sophisticated fraud that combined in-depth knowledge of the company with the use of deepfakes. The fraudsters impersonated the image and voice of the CFO and other employees in a video call, managing to deceive a worker who made a fraudulent transfer of 24 million euros.
  
  

  CEO fraud can involve deepfakes and detailed knowledge of the business.

  
  
  Another significant case was published in November of this year, although on this occasion it was not completed. A popular restaurant in Cartagena (Murcia) was the victim of this type of scam, including the use of artificial intelligence to clone the manager's voice. The fraudsters also managed to gain access to security cameras to monitor the place in real time. The scammers called the venue with the falsified voice of the manager and requested a bank transfer, describing specific details of the situation to lend further credibility to the scam. However, on this occasion, the employee targeted by the scam became suspicious of the deception because some aspects did not match the usual work dynamics.
• Impersonation of social networks or web pages : impersonation consists of appropriating the identity of a person or company with malicious motives, in order to obtain some benefit or cause some kind of reputational damage. To do this, using the information collected about the company on the network, such as brand image, communication style and products offered, a fraudster can create a web page or profile very similar to the original one in some social network to impersonate the company with the aim of deceiving its customers to obtain an economic benefit.
  
  Incibe, for example, reported a recent case in which a website impersonation scheme was dismantled in Spain. The criminal organization carried out impersonations of legitimate online stores dedicated to the sale of high-end electronic products and the fraudulently created websites were identical or very similar to the originals.
  
  Another example of this was published in October this year, when a group of fraudsters fraudulently created a website of a home appliances and electronics business in Vigo (Spain). The fraudsters also impersonated the company on WhatsApp and Wallapop and used, in addition to the image of the company, the specific details of the store, address and VAT number to appear more truthful.

These cases represent only a sample of the many potential attacks or frauds that could affect a company and that could have a higher probability of success when there is greater exposure of accessible information.

Impersonation on social networks and websites can cause reputational and economic damage to companies.

The importance of the digital footprint in corporate security

In this context, the Spanish Association of Companies Against Fraud recently published the Report on Fraud Trends in Companies 2024-2025. According to the report, the companies surveyed recorded a 78% increase in attempted fraud compared to the previous year, and 61% more fraud consummated.

Regarding the fraud channels used, online fraud accounted for 62%, and added to the 20% of the telephone channel, non-face-to-face fraud amounted to 82% of the total.

Knowing the digital footprint should be part of the strategy to protect business integrity and prevent attacks.

The report highlights a growing concern about fraud and its impact on companies, in addition to the fact that fraud through non-face-to-face channels has become a major risk for companies. For this reason, knowing the enterprise digital footprint and continuous monitoring of exposed information plays an important role in a company's security strategy, as inadequate management of accessible information not only makes it easier for criminals to access it, but also increases the likelihood that attacks will be more specific, sophisticated and targeted, raising the risk that potential fraud or attacks will be successfully consummated.

Cyber Security

How Clean Email Business protects SMEs from email cyber-attacks

September 13, 2023