Most of us have received phishing emails in the past. Whether from actual criminals or from IT staff testing our ability to distinguish good from bad, phishing is a reality for all of us. Many phishing attempts are obvious, often intentionally so.
A more difficult to detect phishing scheme has been targeting government contractors, especially GSA Schedule holders. The information in these emails is accurate and personalized. According to the GSA IG, the phishing emails have official looking signature blocks with your contracting officer, use look alike email domains, and have your contract number. Reported subject lines include “Vendor Credentialing Form” and “Records Digitization Non-Compliance.” Included is a link to pay the penalty or administrative fee required to address the issue raised in the email.
The GSA IG recommends reporting phishing attempts to the GSA IG hotline and the FBI’s Internet Crime Complaint Center. If your company falls for one of these schemes, it may make sense to report to local law enforcement (to at least get a police report) and insurance. It is likely, however, that the amount at issue is not worth reporting to either. With the GSA IG and FBI, the federal government may be able to aggregate enough information to justify pursuit of the criminals behind the scheme.
Two more points. This scheme is apparently profitable, so we will continue to see sophisticated schemes targeting government contractors. There is significant data on contractors available publicly, which makes it easy to craft targeted phishing emails. There is also a lot of money in government contracting, and government contractors may be less willing to report cyber incidents due to the certifications they are making concerning cybersecurity.
Second, it is important to confirm that your company’s policies and controls are adequate to address this type of phishing scheme. That means training, spam filters, controls on payments to third parties, and any other measures your cybersecurity team recommend.
If you are concerned that you may be vulnerable to such a phishing scheme, you’ve been a victim of a phishing scheme, or want to discuss your cybersecurity and reporting obligations, please reach out to the author of this post.
Centre Law and Consulting offers legal and technical solutions for cybersecurity, data rights, privacy and related issues. Contact us for a consultation.
