Tim Davies explains why changing your password after a phishing attack doesn't stop attackers. They keep access to your email, monitor communications, and later intercept invoices to redirect payments to fake accounts. The real cost of a breach far exceeds the disruption of quarantining compromised devices.
I heard somebody say in a networking event this morning, there was a quiz about IT security. And the question was, if you've accidentally put in your Microsoft username and password into the wrong thing, does changing your password fix it?
And I had a deep belly laugh. No. We tend to find that what actually happens is they sit inside the networks for, you know, quite some period of time. You know, these are the sort of less sophisticated issues. They sit inside the networks for a period of time, normally inside the 365 mailboxes of like accounts people and things like that. They learn who the suppliers are, they learn who they're trading with and things like that. And then they'll intercept an invoice, change the bank details. I'd probably say that's the most common one these days. You know, and then all of a sudden you get a phone call from the customer, oh, I've just sent 10 grand to the wrong person. Well, call your bank.
And users might think it's a bit disruptive being told, no, you can't use your device anymore. But that's a lot less disruptive than not having a business anymore.
