ACT Systems

🔍 AI is changing the fraud landscape, and not just for high-profile targets.

A recent article from ESET explores how AI-powered OSINT (Open Source Intelligence) is making it easier than ever for cybercriminals to gather and analyse publicly available information.

With AI automating the collection and analysis of data from social media, professional profiles, websites, and other public sources, anyone with a digital footprint can become a target for increasingly sophisticated scams.

The key takeaway is clear: cybersecurity is no longer just about protecting systems and devices. It is also about understanding what information is shared online and how it can be used to build detailed profiles for social engineering and fraud.

As AI capabilities continue to evolve, awareness and digital vigilance are becoming more important than ever.

📖 Read the full article from ESET: https://www.welivesecurity.com/en/privacy/ai-powered-osint-why-everyone-viable-target-fraud/

Soon, some of the calls coming into your business won't be from a real person.

Google has started giving people AI assistants that ring businesses for them. The assistant will call a shop to check if something's in stock, book an appointment, or ask about a price.

For now this is mostly a consumer thing, and it's early. But if a lot of your business comes in over the phone, it's worth knowing about.

Tell your team some callers will be AI, not people. And whatever they say on a call can be recorded, so it pays to be accurate about prices, opening hours and what you've got available.

There's a good side to this too. You can use the same kind of assistant for the dull calls you'd rather not make, like chasing a supplier or waiting on hold.

⚠️ Think before you scan.

QR codes are everywhere, from restaurant menus to business communications. But according to a recent article from ESET, they are also increasingly being used by cybercriminals to bypass traditional security checks and deliver phishing attacks.

A quick scan can lead to a fake login page or malicious website designed to steal sensitive information.

Awareness remains one of the most effective defences. Taking a moment to verify where a QR code leads could prevent a costly security incident.

📖 Read the full article from ESET: https://www.welivesecurity.com/en/business-security/qr-code-phishing-slip-past-corporate-security-measures/

By default, a Microsoft account will accept a login attempt from anywhere in the world.

Most attacks on Microsoft accounts come from overseas, from automated tools trying stolen passwords by the thousand. If your business only works in one or two countries, there's no reason to allow a login from anywhere else.

There's a setting in Microsoft 365 called Conditional Access that lets you block any login from outside the countries you operate in. Someone trying your password from the other side of the world is turned away, even if the password is right.

It won't stop everything, and a determined attacker can route through your country to get past it. But it blocks the flood of automated attempts from places you'll never deal with, and that's most of what you're up against.

You'll need the right Microsoft plan, and it's set up in the admin area, so ask your IT provider to turn it on and set the countries you work in.

When you log into a new tool with your Google account instead of making a fresh password, you're tying that tool to your Google login. Do it enough times and one account controls all of them.

It's quick, so most people click it without thinking.

The trouble starts if someone gets into that Google account. They get your email, and every app you logged into with it, in one go.

Google itself is a risk here too. If it ever suspends or locks your account, you can lose all those apps at once, and getting a Google account back is famously hard.

So for anything your business relies on, give it its own login and password, with two-factor turned on.

And put strong security on the Google account itself, since so much now runs through it.

Everyone's downloading AI tools at the moment, and scammers have caught on.

Say someone on your team wants to try a new AI app. They search for it, click the top result, and end up on a page that looks like the real company's site. They download the app. It's fake, and it steals every password saved on their computer.

The fake sites are hard to spot because they copy the real ones closely, and the link is often an ad shown above the real website in the results.

Security firms have reported a lot more of this over the past year.

Only download software by going to the company's real website yourself, not by clicking an ad or a search result. If a page asks you to install something and you're not sure it's real, don't. And it helps to agree as a team on which AI tools you use, so people aren't installing unknown ones to try them out.

🚨 Your child's newest tutor might not be human.

As children head back to school this week, many will be using AI tools to support their learning. From homework help to personalised tutoring, AI is rapidly becoming part of everyday education.

But while these tools can provide valuable support, they also raise important questions about privacy, safety and the accuracy of the information children receive.

Parents should take time to understand:
🔹 What data AI tutoring tools collect
🔹 Whether children are exposed to inaccurate or unsuitable content
🔹 How much reliance on AI is healthy for developing critical thinking skills
🔹 Which platforms prioritise child safety and privacy

AI has enormous potential to support learning, but it works best when paired with parental guidance, digital awareness and safe online habits.

As we start a new academic year, now is the perfect time to talk to children about using AI responsibly and safely.

📖 Read the full article here: https://www.welivesecurity.com/en/kids-online/ai-tutors-safe-kids/

That slow old laptop your employee is putting up with is costing you more than a new one would.

It's easy to treat a computer as something you only replace when it dies. As long as it still switches on, a new one feels like money you don't need to spend.

Every slow start-up in the morning, every wait for a file to open, every frozen call someone has to drop and rejoin is a couple of minutes gone.

It happens over and over, all day, to everyone stuck on an old machine. Add it up across a year and it's well past the price of a new laptop.

And that's before the frustration, or the fact that old machines stop getting security updates, which makes a slow computer a risky one too.

You don't have to replace everything at once. Just look at how old your team's computers are.

Around the three or four year mark is usually where a machine starts costing you more in lost time than a replacement would.

Ask your staff which computers drive them mad and they'll tell you straight away.

Your IT provider can also point out which ones are near the end of their supported life, since those tend to be both the slowest and the least safe.

Your customers are getting their answer before they ever reach your website.

Search Google for almost anything now and there's a good chance an AI-written answer sits at the top of the page. They already show up on a large share of searches, and that share keeps climbing.

When it's there, most people read it and never click through to a website at all.

That changes how people find you. Someone used to search a question your business could answer, land on your page, look around, and get in touch. Now the AI hands them the answer and they move on, and they never see you.

The businesses that get quoted inside those AI answers are getting more visits than before. So it's worth becoming the source it pulls from.

Start with your website. Make sure it answers the questions your customers ask, in plain words rather than marketing waffle, because that's what the AI picks up.

Keep your Google Business Profile filled out and correct.

And get your name onto other respected sites in your field. The more solid places that mention you, the more the AI leans on you.

If your visitors from search have been dropping and you couldn't work out why, this is a big part of it.

Microsoft has installed Copilot on business computers automatically.

It's worth getting your files in order before you use it.

Copilot can see any file the person using it can already open.

In most businesses, that's a lot more than it should be.

Files get shared with "everyone" for convenience. Folders get opened up for a project and never closed again. It piles up over the years, and no one notices, because no one goes looking through it all.

Once Copilot is in the mix, people don't have to go looking. They ask a question, and it answers using anything it's allowed to see, including files that were left open to the whole company by mistake.

So before you let the team use it, get someone to check your file permissions, starting with HR and finance. People should only be able to see what they need to.