author photo
By Bruce Sussman
Tue | Dec 3, 2019 | 9:46 AM PST

It was a short and rather cryptic US-CERT alert.

And it hit inboxes when most of the United States was out of the office for a long Thanksgiving weekend.

You may have missed it, but you definitely should know about it.

CISA scam is underway

Criminals are dialing for dollars and posing as representatives of the Cybersecurity and Infrastructure Security Agency (CISA). CISA, as you may know, is part of the U.S. Department of Homeland Security.

"CISA is aware of a phone scam where a caller pretends to be a CISA representative. The scammer claims to have knowledge of the potential victim's questionable behavior and attempts to extort money."

You know cybersecurity has become mainstream when scammers are using it in their shakedowns.

This scam is probably worth a mention at your next security team meeting.

Action to take if a CISA scammer calls you

CISA is asking for your help if you or an employee gets a threatening call from someone claiming to be from CISA.

  • Do not respond or try to contact the caller.
  • Do not pay the caller.
  • Contact your local FBI field office to file a report.

BEC scams and high value cyberattack targets

This CISA scam is a new twist on a tried and true method of using fear and threats in phone calls to make money—known as "vishing" (for voice phishing).

It appears to be similar to the fake IRS reps and police impersonators who can keep you out of jail and erase your supposed bad choices if you just pay them some money.

One of the most prevalent scams hitting organizations now is Business Email Compromise, or BEC. Losses have topped $26 billion globally in the last six years.

As a resource, you may was to check out our SecureWorld web conference: Crime and Email: Real-Life Stories from the Trenches. It focuses on BEC, very cyberattacked corporate executives, and strategies to mitigate these things.

You can also check out our recent SecureWorld Sessions podcast on BEC and the business enterprise model which is fueling this cybercrime.