Mailbox abuse, an escalating threat in the financial services sector, involves unauthorised access to an employee's mailbox, often facilitated by weak passwords or non-expiring login sessions. Attackers exploit this by setting up forwarding rules that redirect specific emails to their external mailboxes, allowing them to manipulate conversations and respond on behalf of the victim. The consequences of this form of cyberattack can be severe, leading to substantial financial losses and reputational damage as they can initiate or reroute wire transfers without the victim's knowledge. 

‍

To protect against mailbox abuse, a multi-pronged approach is required, encompassing preventive measures, monitoring, and swift response tactics. Disabling mail forwarding capabilities, enforcing multi-factor authentication, monitoring forwarding rules, and reviewing the RSS feed mailbox folders are some key strategies that can help thwart such attacks.

‍

Mailbox abuse prevention checklist

This condensed, actionable checklist is designed to help organisations in the financial services sector protect against mailbox abuse, reduce the risk of data leakage, and prevent fraud.

‍

Disable mail forwarding capabilities

1. For all users who do not have a business justification, mail forwarding capabilities should be disabled.

‍

Enforce multi-factor authentication

1. Enforce multi-factor authentication for all accounts.
2. Set time-out sessions after 10 minutes of inactivity.

‍

Monitor forwarding rules

1. Regularly monitor forwarding rules and send alerts for any new rule created or deleted.
2. Disable forwarding to external email addresses.

‍

Review the RSS feed mailbox folders

1. Instruct employees to regularly review the RSS feed mailbox folders for hidden email threads.
2. Encourage employees to report any suspicious activity in these folders.

‍

Educate employees about mailbox abuse

1. Conduct regular training sessions on the risks of mailbox abuse and how to spot the signs.
2. Reinforce the importance of strong, unique passwords and regular password changes.

‍

Real-time authentication for major transactions

1. Request your bank to perform real-time authentication with you for major wire transfers.

‍

By implementing these steps, you can significantly bolster your organisation's defence against mailbox abuse.