نصائح أمنية: كيف تتجنب الاحتيال والتصيد وبرامج الفدية
Practical steps for people and companies against payment scams, phishing, deepfakes, BEC and ransomware, plus where to report scams in the US and Brazil.
Instant-payment scams and fake bank call centers
- Banks never call asking for passwords, codes, test transfers or app installs.
- Hang up and call the number on the back of your card or in the official app.
- Set night-time and per-transaction limits and register trusted devices only.
- If it happened, ask your bank to open a refund claim immediately and file a police report.
Phishing by SMS, messaging apps and e-mail
- Distrust urgency: fines, held parcels, blocked accounts, prizes or job offers.
- Do not click: type the official address into the browser.
- A contact asking for money with a relative's photo? Call the person's known number first.
- Turn on two-step verification in messaging apps and social networks.
Voice and video deepfakes
- Agree on a family code word for money requests.
- A celebrity promising guaranteed investment returns is a scam.
- On a suspicious video call, ask the person to turn their head or wave a hand in front of the face.
Passwords and accounts
- Use a password manager and a different password for every service.
- Prefer passkeys or an authenticator app over SMS codes.
- Enable login and transaction alerts for your bank and e-mail.
Business e-mail compromise and fake supplier fraud
- Any change to a supplier's bank details requires call-back to a number already on file.
- Urgent payments requested by executives need dual approval.
- Configure SPF, DKIM and DMARC and tag external e-mails.
Ransomware: the minimum that works
- Immutable or offline backups with regular restore tests.
- MFA on VPN, e-mail, remote access and admin accounts.
- Patch actively exploited vulnerabilities in edge devices first.
- Keep a response plan with legal, insurance and communications contacts.
Personal data incident: the first 72 hours
- Contain, preserve evidence and log the timeline from minute one.
- Assess risk to individuals and check each country's notification deadline (see Regulation).
- Involve the DPO, legal and, if any, your insurer before communicating.
Suppliers and third parties
- Map who accesses your systems and data and with what privilege.
- Add security, notification and audit clauses to contracts.
- Revoke access at the end of every project.
Questions the board should ask
- What are our three costliest incident scenarios and how long would recovery take?
- Did we test backup restores and the crisis plan in the last 12 months?
- Which notification duties and fines apply to us in each country we operate in?
- Does cyber insurance cover ransomware, payment fraud and fines where allowed?