Current:Home > FinanceEmail fraud poses challenges for consumers and companies during the holiday season -Prime Capital Blueprint
Email fraud poses challenges for consumers and companies during the holiday season
View
Date:2025-04-18 16:54:38
With the holiday season upon us, beware "gifts" nobody wants: email fraud and cyberattacks.
Cybercriminals take advantage of consumers' attention on a particular subject — like, for example, Black Friday or Cyber Monday sales — to run scams, or they use the distraction of the moment to cause disruption.
They'll slip into the rush of urgent emails offering limited-time deals, hoping to disguise themselves as legitimate retailers. With the National Retail Federation predicting a record high in spending over the holidays in 2023, cybersecurity is especially important.
Vulnerable email is in part to blame
Cybercrime remains lucrative in part because of the inherent insecurity of email, a form of communication that's typically not encrypted or signed by a verified sender or recipient.
Advancements have been made to help improve that security. Some email providers offer encryption. And if the email looks questionable, the recipient can always open a browser and search for a deal rather than clicking on a link to fact-check whether it's real. Plus, there's a tool called DMARC, the domain-based message authentication, reporting and conformance protocol. It's a long-established best practice to help companies prove who they say they are over email.
But according to new research from the cybersecurity firm Proofpoint, 52% of the top 50 U.S. retailers ranked by the National Retail Federation are not fully compliant with that protocol. Essentially, that means they're not taking steps to block fraudulent emails or protect their websites' domain names.
Proofpoint also noted that only 14% of those companies direct potentially fraudulent emails linked to their brands into quarantine, or the recipient's spam or junk folder.
"So one way to look at this is like Gmail on Black Friday or Cyber Monday. It's kind of like JFK airport over Thanksgiving," says Robert Holmes, who leads email fraud detection efforts at Proofpoint. "Imagine you were at JFK airport on one of those days with a lot of people coming and going, and imagine a world where that airport didn't check IDs or didn't check passports. That would be a bad world. Lots of nefarious activity would happen on busy days in particular."
In many cases, consumers are encouraged to protect themselves in cyberspace by, for example, watching out for phishing emails or not clicking on sketchy links.
However, Holmes argues, more of the burden should fall on companies to implement a layer of protection for all their customers. "So the thing about good security is, it should be invisible to Joe Public," he says.
There's a push to adopt DMARC — or face the consequences
For years, governments have encouraged the adoption of DMARC but haven't required it. With partial adoption, it's difficult for the average consumer to know whether a retailer is verified through DMARC when browsing through marketing emails.
However, that might be beginning to change. Over the years, Google, for example, rewarded companies that complied with DMARC by offering them verification badges that consumers could see. Major email providers have taken various steps to push retailers into adoption.
Now, Google and Yahoo will be taking that a step further by requiring companies to participate by February 2024. If companies fail to implement the protocol, their emails will be more likely to be flagged as spam or blocked entirely.
"In October, Gmail announced new requirements for bulk senders that will make users' inboxes safer and less spammy," said Neil Kumaran, the group product manager at Gmail's security and trust team, in a statement to NPR. "These are straightforward requirements based on open standards, are in line with established industry best practices, and reflect basic email hygiene."
That's an encouraging step toward improving email security, Holmes says.
His only concern is that companies might fail to come into compliance by February.
For larger retailers with a complex web of outside suppliers and contractors, it will be a little more challenging to fully comply, Holmes says. The DMARC protocol factors in every third party authorized to send emails on one entity's behalf, ranging from automated systems that deliver newsletters, like Mailchimp, to those that send updates on doctor's appointments or flight time changes.
"I think the consequences of getting this wrong are severe," Holmes says. "Legitimate email gets blocked. ... People will miss appointments. People will miss flights. People won't make payment."
Of course, those consequences aren't a guarantee — it's just more likely that potentially legitimate email that doesn't comply with DMARC will get blocked. And major email providers have been taking incremental steps toward pushing companies into compliance with DMARC over several years, Holmes says. This decision to require DMARC compliance isn't coming out of the blue.
"Many senders already meet these requirements, and for those who are still working on it, we're sharing clear guidance to help," said Google's Kumaran. "Doing so is crucial to close loopholes we know attackers are targeting, and will help make email safer for everyone."
veryGood! (3)
Related
- Man can't find second winning lottery ticket, sues over $394 million jackpot, lawsuit says
- SpaceX launched a rocket over Southern California after weather delays. Here are the best pictures.
- Trump Media auditor raises doubts about Truth Social's future in new filing
- Man wearing 'Scream' mask kills neighbor with chainsaw then watches movie, affidavit says
- Paula Abdul settles lawsuit with former 'So You Think You Can Dance' co
- New York inmates are suing to watch the solar eclipse after state orders prisons locked down
- Get 2 Benefit Cosmetics Liquid Eyeliners for the Price of 1, 62% off Free People Dresses, and More Deals
- Here's why Angel Reese and LSU will beat Iowa and Caitlin Clark, again
- Mets have visions of grandeur, and a dynasty, with Juan Soto as major catalyst
- April Fools' Day pranks: Apps to translate baby stoner sayings, a ghostbuster at Tinder
Ranking
- Sonya Massey's father decries possible release of former deputy charged with her death
- Bucknell University student found dead, unrelated to active shooter alert university says
- Mass shooting outside Indianapolis mall leaves 7 injured, all children and teens, police say
- Multiple people hurt in Texas crash involving as many as 30 vehicles during dust storm
- The Best Stocking Stuffers Under $25
- Shooting at a Walmart south of Atlanta left 1 dead and a girl wounded. Suspect is on the run.
- Indianapolis police fatally shoot a man after he fires shots following a standoff with a SWAT team
- The Smashing Pumpkins announce additional shows for The World Is A Vampire concert tour
Recommendation
Selena Gomez's "Weird Uncles" Steve Martin and Martin Short React to Her Engagement
Earthquake hits Cedar City, Utah; no damage or injuries immediately reported
Off the Grid: Sally breaks down USA TODAY's daily crossword puzzle, Echo Chamber
Top artists rave about Beyoncé's 'Cowboy Carter' at iHeartRadio Awards
'Malcolm in the Middle’ to return with new episodes featuring Frankie Muniz
Off the Grid: Sally breaks down USA TODAY's daily crossword puzzle, Echo Chamber
How did April Fools' Day start and what are some famous pranks?
Take Center Stage At Coachella & Stagecoach With These Eye-Catching Festival Makeup Picks