Conseils de sécurité : éviter arnaques, hameçonnage et rançongiciels
Practical steps for people and companies against payment scams, phishing, deepfakes, BEC and ransomware, plus where to report scams in the US and Brazil.
Instant-payment scams and fake bank call centers
- Banks never call asking for passwords, codes, test transfers or app installs.
- Hang up and call the number on the back of your card or in the official app.
- Set night-time and per-transaction limits and register trusted devices only.
- If it happened, ask your bank to open a refund claim immediately and file a police report.
Phishing by SMS, messaging apps and e-mail
- Distrust urgency: fines, held parcels, blocked accounts, prizes or job offers.
- Do not click: type the official address into the browser.
- A contact asking for money with a relative's photo? Call the person's known number first.
- Turn on two-step verification in messaging apps and social networks.
Voice and video deepfakes
- Agree on a family code word for money requests.
- A celebrity promising guaranteed investment returns is a scam.
- On a suspicious video call, ask the person to turn their head or wave a hand in front of the face.
Passwords and accounts
- Use a password manager and a different password for every service.
- Prefer passkeys or an authenticator app over SMS codes.
- Enable login and transaction alerts for your bank and e-mail.
Business e-mail compromise and fake supplier fraud
- Any change to a supplier's bank details requires call-back to a number already on file.
- Urgent payments requested by executives need dual approval.
- Configure SPF, DKIM and DMARC and tag external e-mails.
Ransomware: the minimum that works
- Immutable or offline backups with regular restore tests.
- MFA on VPN, e-mail, remote access and admin accounts.
- Patch actively exploited vulnerabilities in edge devices first.
- Keep a response plan with legal, insurance and communications contacts.
Personal data incident: the first 72 hours
- Contain, preserve evidence and log the timeline from minute one.
- Assess risk to individuals and check each country's notification deadline (see Regulation).
- Involve the DPO, legal and, if any, your insurer before communicating.
Suppliers and third parties
- Map who accesses your systems and data and with what privilege.
- Add security, notification and audit clauses to contracts.
- Revoke access at the end of every project.
Questions the board should ask
- What are our three costliest incident scenarios and how long would recovery take?
- Did we test backup restores and the crisis plan in the last 12 months?
- Which notification duties and fines apply to us in each country we operate in?
- Does cyber insurance cover ransomware, payment fraud and fines where allowed?