It’s a tale as old as time. A person thinks they are doing the right thing and does not know that another is deceiving them. That is the crux of cyber scams in today’s marketplace. An email from a Nigerian Prince who needs help moving money. A long-term internet chat with someone who claims to be a celebrity but needs money. That email from your company’s CEO ordering you to move a large amount of money to a new vendor.
Being deceived is not limited to specific individuals. PhDs from Ivy League Universities are as acceptable to deception as any one of us. What is it about these types of scams that even the simplest in form can cause the mighty to stumble?
Most of the day, humans run on mental shortcuts that science calls heuristics. They’re efficient—and in normal life, they’re usually adaptive. Scams succeed by designing messages that force you onto that mental shortcut path. Pushing you away from slower, analytical thinking.
The most common “shortcut levers” show up again and again:
-
Authority (“This is your bank / the IRS / your CEO”)
-
Scarcity & urgency (“You have 10 minutes”)
-
Social proof (“Everyone is doing this / your coworkers already complied”)
-
Reciprocity (“We helped you—now do this small thing”)
-
Commitment/consistency (“You started the process, finish it”)
-
Liking/rapport (romance scams, friendly support-agent tone)
Scammers create an emotional state that downplays the need for verification. The Federal Trade Commission warns that scammers push speed and isolation. The idea of “act before you have time to think, check, or reach out.”
Common phrases you hear are:
-
Fear: “Your account is compromised / law enforcement is involved.”
-
Time pressure: “If you don’t act now, you’ll lose access/money.”
-
Shame/embarrassment: “Don’t tell anyone… You could be in trouble.”
-
Hope/greed: investment/crypto “opportunities.”
-
Attachment/loneliness: romance scams.
-
Relief: “Good news—we can fix this for you.”
The most successful cyber scams are the low-tech attacks on human workflow. The FBI’s 2024 Internet Crime data show the top three cyber-crimes by number of complaints are:
-
Phishing/spoofing
-
Extortion
-
Personal Data Breaches
When you look at Business Email Compromise scams, the above cyber-crimes show up. Businesses run on
-
Routine exceptions
-
deference to seniority or authority
-
payment urgency or general urgency to a given matter
-
Normalization of unusual requests: “We are closing a deal; do this now.”
What is a business to do to empower employees to avoid these scams?
Create policies and procedures to prevent mistakes.
-
Any request to wire money must be confirmed with two forms of communication. For example, an email from the CEO comes to accounting requesting payment to a certain vendor. The accounting department calls the CEO back to verify the veracity of the request.
-
Follow the same procedure when a vendor emails the change of banking information. The accounting department should call the vendor to verify the information.
-
Never use the same form of communication to verify information. Thus, if you receive an email asking for a large check, do not use email to verify. Scammers usually only compromise one form of communication.
Establish ongoing phishing and email scam training for your employees
-
Show examples of email scams that have come to your company and point out how you can tell they are scams. For NJ businesses, you can join the NJ Cybersecurity & Communications Integration Cell. They provide weekly emails of cyber scams that impact businesses. Membership is free.
-
Successful organizations have implemented phishing email training programs to train employees. These are usually paid services. Some Cyber Insurance companies offer discounted or free services through vendors.
Install technology to prevent malicious emails
Install technology that can help prevent malicious emails from coming into your organization. Do not rely on one technology. Taking a layered defense approach is strongly recommended by cybersecurity experts.
Install a Secure Email Gateway (SEGs)
A Secure Email Gateway acts as a shield between the public internet and your internal email system. It inspects incoming mail and blocks known threats using reputation scoring, threat intelligence, and advanced filtering.
Advanced Email Filtering & Spam Protection
Email filtering solutions analyze every message’s content and metadata to identify spam, scams, and malicious content before it ever hits a user’s inbox.
Use Email Authentication Standards (DMARC, SPF, DKIM)
Authentication protocols allow mail providers to verify who is allowed to send email from your domain. Property implementation means that many spoofed and fake emails, those pretending to be your brand, will be rejected automatically. Automating and enforcing these standards dramatically reduced malicious impersonation.
AI-Powered Threat Detection and Behavioral Analysis
Scammers are using AI to make malicious emails look legit. For the good guys, there is AI and machine learning technology to detect patterns and anomalies that traditional filters miss.
Anti-Phishing Filters & URL Protection
Anti-phishing systems specialize in identifying malicious links and phishing text by comparing URLs and content to known bad-actor lists and applying real-time analysis.
Email Quarantine & Sandbox Technologies
Rather than blocking outright, some systems route suspicious mail to a quarantine area where it can be reviewed by IT or automated engines for further analysis.
Integration with Threat Intelligence Platforms
Enterprise email security often integrates with threat intelligence feeds – real-time data about known malicious actors, domains, and attack patterns to improve filtering accuracy. This can include shared blacklists, reputation scoring, and automated blocking of high-risk senders.
Install Multifactor Authentication (MFA)
While this is not a technology that prevents malicious emails, it can help limit the impact of a compromised account. For example, if an attacker tricks a user into revealing their user ID and Passwords, MFA could stop the hacker from logging in with those credentials.
Summary
Cyber scams will endure because deception has always been part of the human story. It’s the tools that have changed. Snake oil salesmen had to do their deception in person. Now it’s done at scale, speed, and frightening realism. Businesses that understand this shift don’t ask their employees to “be smarter.” They redesign systems to assume pressure, distraction, and human fallibility. When verification is implemented into workflow and technology supports, not replace human judgment, deception loses its power.
Image by Gustavo Fring on Pexels.
About the Author:
Scott T. Harrigan (CIC, CRM, CCIC) has over 30+ years of experience in the insurance industry. He creates comprehensive insurance and risk management portfolios for clients. In addition to creating portfolios, he enjoys writing and teaching about various insurance coverages and risk management topics. Scott is an active member of the Rue Insurance Educational Team, providing continuing education classes to Rue Insurance professionals on an annual basis.
