October marks the start of Cybersecurity Awareness Month, and just last week, millions of ASOS customers discovered their personal details had fallen into the hands of criminals. Following the breach on 9th October, ASOS said in a notice to shareholders via the London Stock Exchange that the pop-up notification customers received was sent by an “unauthorised third party” and that basic personal information, including names and contact details, may have been accessed.
On the surface, the incident might sound less severe because passwords and bank details don’t appear to have been leaked. But personal contact data, including names, addresses, and phone numbers, gives criminals the key details they need to build far more convincing attacks.
“The most effective scams don’t always look obviously suspicious and may come from recognisable brands, such as ASOS,” says Kamran Bahdur, Chief Information Officer at FLR Spectron. “Criminals are becoming increasingly sophisticated at impersonating trusted organisations and creating a sense of urgency to get people to give up their personal data.”
Why Basic Details Are Valuable to Scammers
Criminals use personal information to carry out social engineering attacks. Instead of breaking into a system, they send messages that feel personal and believable and rely on the recipient to do the rest.
With the right details, fraudsters can impersonate ASOS or a third-party payment provider through emails, text messages and phone calls. These messages often use urgent language designed to make people act before they check whether the communication is genuine.
“A message saying that you need to verify your bank details before a purchase can be made can cause someone to act quickly without stopping to question whether the message is genuine,” explains Kamran.
The goal is rarely the first click. The goal is to get access to more information, including banking details.
5 Signs an Unexpected Message Could Be a Scam
Scam messages are getting harder to spot, but most share a handful of warning signs. Here are five to look out for:
- You’re told your payment is at risk.
Scammers often create a false sense of urgency, claiming a payment has been blocked, delayed, or suspended unless you act immediately. - You’re asked to click a link to verify your details
Unexpected links in texts and emails should always be treated with caution, particularly when they ask for login, personal or banking information. - The message asks for information you wouldn’t expect to provide
Requests for passwords, full banking credentials or other sensitive information should raise immediate concerns. - You’re pressured to act immediately
Warnings that your payment will be cancelled unless you respond within a short time frame are a common social engineering tactic. The panic is deliberate, because it stops you from thinking. - The message arrives out of the blue
Even if a message appears to come from a trusted organisation, verify it independently. Go to the retailer’s website or app and log into your account rather than responding directly.
What To Do Instead
ASOS customers, and consumers in general, should be particularly cautious right now about any unexpected message asking them to click a link, provide personal information, or share banking details.
“If something doesn’t feel right, don’t use the link or phone number provided in the message,” says Kamran. “Instead, go directly to the official company website or app, log into your account and check your details there.”
A few simple habits make a big difference:
Stop and think before you click. This applies even to messages from brand names you know and trust.
Go direct. Access your account through the official website or app, not through links in texts or emails.
Never share your passwords or bank details in response to an unsolicited message.
Use strong, unique passwords and turn on multi-factor authentication wherever it is available.
Speak to someone first. If a message makes you feel panic or alarm, a second opinion can prevent a mistake.
Remain Vigilant Of Future Phishing Attacks
A breach like this is rarely over when the headlines disappear. Attackers can use the stolen details for weeks or months afterwards, and follow-up scams are often more convincing precisely because they use real information.
“The best response to a suspicious communication, even from a recognisable brand, is to slow down,” says Kamran. “No matter how convincing or urgent a message appears, take a moment to independently check whether it is genuine before handing over any information.”
At FLR Spectron, we help businesses and their people build the habits that stop social engineering in its tracks. From phishing awareness to wider security support, our goal is to keep you protected without getting in the way of how you work.
If you would like to talk through your own setup, get in touch and one of our specialists will be happy to help.