Rob Rees, Divisional Director of insurance firm Markel Direct, highlights the common cyber threats facing SMEs and sole traders as electrical contractors turn to social media to entice new business
A recent study by Markel Direct revealed that over half (54%) of small business owners spend one-to-three hours per week making content for social media, with 84% revealing the platform generates business for them and 72% considering social media to be essential to their success.
But alongside opportunities, this marketing channel also comes with risks to the cyber security of these small businesses.
Six social media risks facing small businesses
Account takeover
Through weak or reused passwords, poor security settings or phishing attacks, cyber criminals can gain access to business social media accounts and take them over. This then gives them the ability to lock the owners out, allowing them to scam clients or customers, extort business owners and post content that could damage the business’ reputation.
To help prevent this from happening, businesses should use passkeys where available. Where passwords are used, they should be strong and unique to each account, ideally managed through a reputable password manager, with multi-factor authentication enabled.
Phishing and fake platform messages
Cyber criminals can create convincing direct messages or emails that appear to come from a social media platform, customer, or supplier. This is to trick SMEs and sole traders into giving away information or login details. These messages may claim that an account is about to be suspended or deleted, or they might ask the recipient to verify their details by clicking on a link. With the introduction of free AI tools, these scams are becoming increasingly harder to spot.
It is unlikely that business owners can stop these messages from being received, so prevention is more about awareness of scams and knowing what to check for. Businesses should be cautious when receiving unexpected messages and avoid clicking on links unless they are sure they are genuine. Always check the email address or profile where the messages have come from before cross referencing them with genuine accounts.
Any requests should be checked through official channels and anyone with access to the business’ social media accounts should be given training or guidance on the common signs of a phishing scam.
Impersonation and fake business accounts
Another potential threat, particularly for smaller brands, is people creating fake social media profiles that appear to belong to a genuine business or sole trader. They may then use these accounts to contact customers, ask for payments or promote fake offers or competitions, which could result in a financial loss for the customer or the business, as well as damaging the reputation and trust of the real business.
To avoid these outcomes, businesses should regularly check social media platforms for fake or copycat accounts and report them as soon as they are discovered. This can also help to make it clear which accounts are real, before warning customers to be cautious of any suspicious messages or communications coming from profiles which are not genuine.
Oversharing information
Information shared on social media, including employee names, contact information, business locations, upcoming projects and even video content or images from within the company premises, can give cyber criminals the information they need to target a business. For example, a fraudster could use publicly available staff information to impersonate a colleague, supplier or senior manager and send convincing scam emails.Even small details can be used to build a picture of how a business operates and make scams or phishing attempts appear more convincing.
Businesses who regularly use social media should consider thinking carefully about the information they share online and whether it is necessary to make certain details public. Having clear guidelines around social media use can help, particularly when it comes to avoiding the sharing of sensitive business information or posting operational details in real time.
Social engineering and business impersonation
Like using information shared about a business, scammers can also use information found on LinkedIn and personal social media platforms to impersonate a business owner, colleague, customer or supplier. This could allow them to make a fraudulent request, such as asking for a payment to be made or requesting changes to bank details, appear genuine.
To help prevent this, businesses should take extra care when receiving unusual or urgent requests, particularly where money or sensitive information is involved. Rather than relying on the contact details provided in the message, the request should be checked using a known and confirmed phone number, or in person if possible.
Malicious links and fake customer enquiries
Cyber criminals could also try and pose as potential customers, collaborators or brands and use comments or direct messages to send malicious links or files. If these are opened, they could be used to steal login details, gain access to accounts or install malware onto a device.
It is important to always use caution when receiving unexpected links, files or messages, especially from unknown contacts. The identity of new contacts should be checked before opening anything, while security software and devices should also be kept up to date.
What should you do if your business falls victim to a social media cyber-attack?
Even when businesses take steps to protect themselves, it is not always possible to prevent a cyber-attack from happening, particularly as cyber criminals and their methods become more sophisticated, such as using AI. If a business does fall victim to such an attack, acting quickly can help to limit the financial, operational and reputational impact. Here’s what you can do:
Secure the affected account: Change passwords as soon as possible, remove any unrecognised devices or users with access, and enable multi-factor authentication where possible.
Contact the platform: Report the issue through the social media platform’s official reporting channels.
Warn customers and contacts: If scammers have used the account or created a fake account to contact customers or followers, let them know through another trusted channel so they are aware of any potential scams.
Keep evidence: Take screenshots and keep any messages, emails or other information that could help when reporting or investigating the incident.
Check other accounts and systems: If login details or other information may have been compromised, check whether the same details are used elsewhere and secure any other accounts that could be affected.
Report the incident where appropriate: Consider whether the incident involves fraud, crime or a personal data breach and seek appropriate advice promptly. Certain personal data breaches must be reported to the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of them. You should document the incident and your assessment even where you decide that an ICO report is not required.
Check your business insurance: A cyber-attack can lead to financial loss, disruption to the business, and costs associated with responding to and recovering from the incident. Cyber insurance may provide cover for certain financial losses, incident-response services and recovery costs following a cyber incident, subject to the policy’s terms, conditions, exclusions, limits and excess.
Rob Rees is Divisional Director of Markel Direct
For more on cyber security, click here.
