Preventing Cyber Crime & Fraud: Email Security

This advice has been collated by East Midlands Special Operations Unit (EMSOU) to raise awareness among businesses and the public.

If you require any further information, assistance or guidance please contact the EMSOU Protect Team EMSOU Protect Team or your local Force protect team.

Today’s cyber topic is Email Security

For many organisations there is a genuine concern that a malicious threat actor will send emails to others, making it seem that the organisation has sent them. This form of attack – known as ‘spoofing’ – is a concern because individuals and organisations the company does business with, will think the emails are genuine. This makes it easier for criminals to commit fraud, compromising the confidentiality and integrity of the communications. Dealing with the aftermath and reputational harm is both expensive and time consuming.
Good email security involves:

Sender Policy Framework (SPF)
SPF is an email authentication technique, which maintains a list of authorised mail servers. These mail servers are the official point of origin of email communications from an organisation. When the recipient receives an email, the SPF record is used to check that the email originated from an authorised mail server.

DomainKeys Identified Mail (DKIM)
The DKIM is part of a process that lets you ‘sign’ an email, even ones that you forward. This ‘digital signature’, is used to prove that the email address was not ‘faked’ or ‘altered’.

Hot Topic: Top 10 COVID-19 and lock down frauds, identified by Finance UK

• Fake government emails offering grants
• COVID-19 relief funds
• Council Tax reduction emails
• Universal application help
• Fake NHS Test and Trace
• Fake adverts for COVID related products
• TV Licensing fake emails and texts
• Online TV subscriptions fake update emails
• Fake profiles on social media for online dating
• Social media advertising fake investment opportunities (Bitcoin etc.)

Reporting
Please report all Fraud and Cybercrime to Action Fraud by calling 0300 123 2040 or online.
Forward suspicious emails to report@phishing.gov.uk.
Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).