Cyber-fraud: Eight protection measures from EKAD against phishing and social engineering
The Greek Internet Safety Centre warns of increasingly sophisticated digital fraud schemes using Artificial Intelligence.
Digital fraud: Time pressure as a central manipulation tool
Digital fraud targeting citizens and public organisations is becoming increasingly organised and targeted, with attacks that in minimal time lead to financial loss, data theft or account compromise. This is the assessment of the Greek Internet Safety Centre (EKAD), as reported by Naftemporiki following a relevant announcement by the organisation.
According to EKAD, the era in which an electronic "phishing" message could be easily identified by spelling errors or crude presentation is gradually receding. Perpetrators now use websites that closely replicate the environment of banks and organisations, forged sender addresses, counterfeit emails and SMS messages, as well as telephone calls.
Social engineering and the role of Artificial Intelligence
The perpetrators' goal is not always to breach a security system. They frequently seek to manipulate the user themselves, in order to get them to click a link, reveal confidential information or approve a transaction. This is the essence of social engineering: the exploitation of trust, fear, curiosity or time pressure, so that the victim acts without performing the necessary checks.
Messages such as "your account will be blocked", "suspicious transaction detected" or "you must act immediately" are designed to provoke hasty reactions. The sense of urgency itself constitutes an important warning sign, EKAD notes.
Generative Artificial Intelligence tools exacerbate the problem, as they facilitate the mass creation of linguistically correct and personalised messages, the imitation of human voice, the creation of fake images or videos, as well as the reproduction of the style of known individuals or officials. AI significantly increases the speed, scale and persuasiveness of known forms of fraud.
The main forms of digital fraud
EKAD records the most common forms:
- Phishing: Deceptive email that leads to a fake website or requests confidential information.
- Smishing: Similar fraud attempt via SMS or messaging application.
- Vishing: Telephone call from a person posing as a bank employee, accountant or public service representative.
- Fake banking websites: Clone websites that steal whatever the user types.
- Fraud through online advertisements: The alleged buyer sends a link so the "seller receives payment", directing them to a fake banking page.
- Business Email Compromise (BEC): Impersonation or compromise of business communications, aimed at issuing an order for urgent payment or changing IBAN.
The common denominator is the creation of trust and pressure so that the user bypasses normal control procedures.
Eight protection measures
EKAD proposes eight specific measures:
1. Do not access e-banking via a link. We type the bank's address ourselves or use the official application. 2. Check the entire web address. Minor changes in letters, hyphens or suffixes may lead to a fake website. 3. Do not disclose passwords, PINs or one-time codes. Banks and legitimate services do not request full login details by telephone or message. 4. Careful examination of every login or transaction notification. Before every approval we check the amount, the recipient and the action displayed on screen. 5. Enable multi-factor authentication (MFA). Adds a layer of protection without substituting careful examination of every request. 6. Verify financial requests through a second, independent channel. IBAN changes, new recipients and unusual payments are verified by telephone, using a number we already know. 7. Use different and strong passwords. A password manager limits the risk of reuse and helps identify fake websites. 8. Stop at every message that pressures you for immediate action. Time pressure is a manipulation technique, not a reason to bypass checks.
HTTPS is not a guarantee of authenticity
EKAD also recalls that the padlock and HTTPS indicator mean only that the connection to the website is encrypted — they do not prove that the website actually belongs to the bank or organisation it claims to represent. Therefore, neither a linguistically correct message nor a familiar voice constitute proof of identity by themselves.
If someone posing as a relative, colleague, supervisor or accountant suddenly requests money or banking details, EKAD recommends immediately terminating the communication and reconnecting via a number the user already knows. Speed of response is decisive: there is no need to wait for confirmation of use of the details before taking action.
Source: Naftemporiki