Condominium associations are attractive targets for cybercriminals. Associations maintain banking information, owner and employee contact information, payment records, vendor contracts, and more — all appealing to online thieves. A successful cyberattack can result in stolen funds, compromised personal information, operational disruption, and significant recovery costs.
Social engineering is one of the most common cyber threats. The distinct difference between this and other fund transfer fraud is that social engineering leads to the voluntary transfer of funds from an association to an attacker, instead of fraud arising from the hacking of computer systems or accounts. In this type of scheme, a criminal impersonates a board member, property manager, vendor, or insurance professional. The bad actor sends a convincing email requesting a wire transfer, a change in payment instructions, or convinces someone to disclose sensitive information. Often, criminals monitor email accounts and wait for an actual project or transaction before sending fraudulent instructions.
Associations need to understand that standard crime or cyber policies may not automatically cover social engineering schemes. Some crime fidelity policies offer small limits. However, higher limits are found in a cyber policy. Coverage terms vary, so boards should confirm whether the policy covers fraudulent instructions involving association officers, employees, property managers, and outside vendors.
Boards can reduce the risk by adopting several basic controls:
- Before changing payment instructions, require verbal confirmation using a previously verified telephone number.
- Require two authorized individuals to approve wire transfers and large payments.
- Use multifactor authentication for email, banking, and management systems.
- Educate those who manage funds to recognize phishing emails and suspicious links.
- Limit access to financial and confidential information.
- Maintain secure backups and a written cyber-incident response plan.
Because human manipulation lies at the heart of social engineering, relying on technology alone isn’t enough. With ongoing education and dedicated social engineering insurance coverage, associations can build a strong line of defense and protect their community’s assets from sophisticated deceptive scams.
Don’t Let it Slide: Preventing Slip and Fall Hazards
