As our reliance on the internet and digital devices for business and personal use increases, so do opportunities for criminals seeking to steal information for financial gain. Cyber criminals and fraudsters are also becoming more sophisticated in their attempts to lure people into clicking suspicious links, downloading e-mail attachments, or “connecting” on social media, which are often gateways to stealing sensitive information. Fraudsters may pose as legitimate organizations, like Goldman Sachs, and create fraudulent websites, send e-mails, or make phone calls to solicit monetary payments. These scams are complex, as the perpetrators often use real employee names and replicate Goldman Sachs branding and proprietary documentation.
Goldman Sachs places great importance on cybersecurity and fraud prevention and has programs and technical controls in place to protect client accounts and information. To help improve your personal cybersecurity posture, we offer the following information about cyber threats and guidance to help protect you, your family, and your employer from falling victim to a cyber-attack or fraud scam.
Any organization or individual can be a target of cyber criminals. Here are some of the most common tactics and types of attacks employed by these actors:
Malicious E-mails and Websites
An unsuspecting e-mail from your bank or favorite retailer may secretly be an attempt to steal your identity or personal information. “Phishing” is a common tactic of cyber criminals that relies on “spoofed” e-mails or fraudulent websites (that look and feel like a well-known website) to collect personal and financial information or infect your device with malware and viruses. Criminals use this stolen information to commit identity theft, credit card fraud and other crimes. Phishing can also occur by telephone and is becoming increasingly prevalent on social media and professional networking sites.
When you click a malicious link, you may unknowingly install malicious software (malware) on your device. Malware refers to software that is intentionally designed to cause damage to a digital device. The most common form of malware is a virus, which is typically designed to give the criminals who create it some sort of access to the infected devices. Ransomware is another type of malware that is becoming increasingly prevalent. Ransomware accesses a victim’s files, locks and encrypts them and then demands the victim to pay a ransom to get them back. Ransomware is like the “digital kidnapping” of valuable data – from personal photos and memories to client information, financial records and intellectual property. Any individual or organization could be a potential ransomware target.
Credential-based Attacks
If you use the same username and password combination across different websites or services, you are particularly susceptible to this cybercrime technique where stolen account credentials are used to gain unauthorized access to a user’s various other online accounts. Credential stuffing attacks can often go unnoticed until funds are transferred.
Social Media Impersonation
Criminals are increasingly using social media to build relationships with victims and ultimately steal data. Typically, these actors create fake accounts that appear (and claim) to be official accounts for an individual or organization. Social media impersonation can also refer to the takeover of real accounts. These accounts can be used for phishing activities or causing an individual or a company reputational damage.
Financial fraud occurs when someone takes money or other assets from you through deception or criminal activity. Here are some common examples of financial fraud:
Investment Scams
Investment scams involve getting you or your business to agree to a financial transaction on the promise of a questionable financial opportunity. To perpetrate these scams, fraudsters typically present the opportunity by making contact by e-mail, through a website, or by phone, often going through great lengths to gain the victim’s trust or attempt to form a genuine relationship. These offers are typically low-risk high-reward investments that typically sound “too good to be true”— because they are! To evaluate whether you are the target of an investment scam, you should consider:
Identity Theft
Identity theft occurs when someone steals your personal information and uses it without your permission. Examples of how your information could be used include opening bank accounts, taking out credit cards and loans or applying for government benefits and documents in your name.
There is no definite rule on how to protect yourself from identity theft however, in addition to the cybersecurity good practices listed above, you can protect yourself by:
Business E-mail Compromise
Business E-mail Compromise (BEC) scams are carried out when a cybercriminal compromises legitimate business or personal e-mail accounts to intercept the communication between the victim and their business partner or to conduct unauthorized transfers of funds. Fraudsters commonly tend to intercept e-mail wire instructions from investments firms, real estate agencies, and art dealers to then impersonate a trusted source.
In addition to the cybersecurity good practices listed above, protect yourself by:
If you receive a cold call or e-mail from Goldman Sachs that you are uncertain about, or which you believe to be fraudulent, please forward it to abuse@gs.com. If you are a client of the firm, please notify your sales representative or investment professional, as well.
For further information on staying safe, the following resources provide helpful information:
United Kingdom
Greater China
Singapore
United States
Marcus by Goldman Sachs®
Our weekly newsletter with insights and intelligence from across the firm
By submitting this information, you agree to receive marketing emails from Goldman Sachs and accept our privacy policy. You can opt-out at any time.