A LITTLE BIT ABOUT CYBERCRIME

With the development of technology and widespread internet use in virtually all spheres of life and business, every entrepreneur in Latvia can become a victim of cybercrime, and unfortunately, many already have.

The Latvian Criminal Law does not contain a definition of cybercrime. Such a definition is also absent from the Budapest Convention on Cybercrime. However, this certainly does not mean that cybercrimes are not punishable in Latvia. Overall, several types of cybercrimes for which criminal liability is provided can be identified in the Criminal Law. These include, for example, computer fraud, unauthorized access to an automated data processing system, illegal actions with financial instruments and means of payment, the acquisition, manufacture, modification, storage, and distribution of data, software, and equipment for illegal actions with electronic communications network terminal equipment, violation of information system security rules, and others. In fact, cybercrimes in the Latvian Criminal Law, similar to the Budapest Convention on Cybercrime, cover various objects of criminal offense groups, namely: criminal offenses against fundamental human rights and freedoms—privacy and secrecy of correspondence; crimes against property; criminal offenses in the national economy; as well as criminal offenses against general security and public order.

CYBERSECURITY THREAT GROUPS

At the European Union level, nine main groups of cybersecurity threats are identified: ransomware—attackers encrypt an organization’s data and demand payment to restore access; cryptojacking—cybercriminals secretly use a victim’s computer power to create and generate cryptocurrency; data threats—data breach incidents; malware—software that activates a process to affect system operation; disinformation—the spread of misleading information; non-malicious threats—human errors and incorrect system configuration; threats to availability and integrity—attacks that prevent system users from accessing their information; email-related threats—the goal is to manipulate people into becoming victims of an email attack; supply chain threats—attacks on, for example, a service provider to gain access to client data.

PHISHING

Phishing remains a current issue in Latvia. It is a fraudulent online activity directed at a specific person via email or mobile phone, where the fraudster poses as a “legitimate” data processing institution (bank, insurance company, business partner, etc.) to uncover personal information. There are many examples of phishing. Cybercriminals can create a fake website that looks identical to a bank’s or another online payment system’s site. Users are then invited to visit this site and enter their confidential data. Typically, users are lured to the fake site through mass-sent emails purportedly from a bank or another real financial institution, containing a hyperlink to the fraudulent site. If a user clicks on it, they arrive at the webpage created by fraudsters, where they are asked to enter their data. Furthermore, in practice, cybercrimes are still frequently carried out by people themselves activating infected files received, for example, in an email or a social media message, as well as by visiting suspicious websites. In the case of courier fraud, while shopping, one might visit a website very similar to a real homepage and enter the information and data required for the purchase.

With the help of malicious software, it is possible to intercept text entered via a computer keyboard. Some malicious programs can even infiltrate a client’s internet browser, and when the client starts using internet banking, a fake form is displayed, prompting them to enter authorization codes to supposedly confirm a security certificate. Spyware—secretly collects data and information about the user using their internet connection. The obtained information can be passed on to interested persons or organizations.

THE INTERNET – A RISK

According to the State Police, fraud on websites and communication media has significantly increased in Latvia during the Covid-19 pandemic, and cybercrime risks have also risen. Globally, the number of cybercrimes increased during the pandemic, mainly due to the fact that people spent much more time at home on the internet than usual during Covid-19 restrictions. Even after the pandemic, habits have not significantly changed. People have grown to prefer remote meetings, working from home, online shopping, and social networks. Life without computers, mobile phones, tablets, and remote meetings, or shopping without the internet, is no longer imaginable. However, where there is the internet, there are also cyberattacks and cybercrimes.

What distinguishes cybercrimes from other types of crimes is that both the criminals and those involved in their detection require special technical knowledge and speed. Compared to other crimes, the detection rate for these crimes remains relatively low. In Latvia, in 2021, out of 875 registered cybercrimes (according to the Budapest Convention on Cybercrime), only 268 crimes were solved.

WHERE IS THE “CATCH”

The problem is that cybercriminals are able to very realistically imitate genuine organizational links and communication. An email might be missing a single dot or a single letter; a call might come from a “bank” or “police” phone number (as it will appear visually); cybercriminals may be aware of your conversations with business partners; and you may be automatically redirected against your will to a visually very similar website where you will make a purchase or provide your personal data.

One of the most unpleasant things for you may turn out to be that, in reality, you are the victim, but legally the victim may be the state. A cybercrime has been committed against you and money has left your account, but the persons who committed the crime against you may be charged with money laundering, where the victim is the state.

In such a case, you will have to reckon with the freezing of funds and the impossibility of quickly receiving your money back. You may find yourself needing to prove the legal origin of your own funds. Regarding the recovery of funds, you may have to compete with the state in your status as a victim. Problems can be even greater if your money went into several accounts and directions where it is difficult to track.

There may also be situations where someone used your or your company’s credit card to shop online, or took out a loan in your or your company’s name, which was then spent. In such a case, it is important to submit evidence that you did not make the purchase yourself and did not take out the loan. Otherwise, you or your company may have a civil liability to pay for the purchases and the loan.

RECOMMENDATIONS

To reduce the risk of attacks, antivirus programs should be used, one should refrain from visiting suspicious websites and opening suspicious email attachments, anti-phishing systems should be used, and other precautionary and security measures should be taken. In Latvia, it is also essential to report cybercrimes to the Information Technology Security Incident Response Institution (CERT.LV), whose task is to promote information technology security in Latvia, and to the Economic Crimes Enforcement Administration.

In Latvia, the Financial Intelligence Unit has developed an information booklet titled “Most Current Types of Fraud.” The booklet lists, in a concentrated form, the scenarios of fraud in the digital environment most frequently identified in practice and highlights “red flags” that may indicate potentially fraudulent activities. It identifies phone fraud, investment fraud, fake brokers, and courier fraud. It is undoubtedly useful to familiarize yourself with it, as well as to introduce it to your employees.

One must be especially cautious with suspicious emails with attachments (the most important thing here is not to open the attachment), with emails regarding changes in payment details (here you must check the sender’s data and call your business partner, as well as send a confirmation email to the partner’s official email address), and with calls from the “bank” regarding cybercrime attempts, access to your account, password updates, and your sensitive data. Be vigilant and careful. Your bank already has everything, and the bank does not call to ask for anything regarding your data and passwords.

What might not yet be so well known is that fraudsters can call from a number that resembles a bank or police number. Always remember that neither the bank nor the police will ever ask for your sensitive data over the phone. Furthermore, you have no obligation to answer over the phone, especially regarding your account, passwords, and sensitive data. For example, it might happen that someone calls purportedly from your bank and says there was an unauthorized attempt to access your account and, supposedly for security purposes, asks you to provide your password for comparison.

If it has already happened and you see that funds have disappeared from your or your company’s account or have gone to another account without your knowledge, call the bank immediately (it is also good to write an email or a message via internet banking), explain what happened, ask to block the account, and go to the nearest police station, write an application, ask to freeze the funds, and to be recognized as a victim. Afterward, inform the bank. If you happened to take out a fake loan that was then transferred to another account, also warn the “lender” (who may be involved in the fraudulent scheme or may be a victim just like you) that you believe fraud has occurred and that you have contacted the police.