When there is something new, confusing, and much-hyped on the Internet, you can bet criminals are going to find a way to exploit it.
That is so far the case with the General Data Protection Regulation (GDPR), the data privacy rules for all individuals within the European Union (EU) and European Economic Area that went live Friday.
The primary aim of GDPR is to provide EU citizens and residents more control over their personal data. It is also intended to simplify the regulatory environment for international business by providing a comprehensive, yet uniform, set of regulations. While its aim is to simplify, however, GDPR has been presenting its fair share of problems, especially to U.S. businesses that are still battling with confusion and uncertainty of whether and how GDPR applies to them.
You may have noticed that amid the transition to the new requirements of GDPR, businesses around the world are scrambling to update their privacy notices. As they do, they are flooding our in-boxes, advising us of the changes made to their privacy policies in valid attempts to comply with GDPR. Unfortunately, however, we are now also seeing criminals exploiting this confusion. Industry experts and associations, including those in banking and financial services sectors, are reporting that criminals are now spoofing bank and other businesses with phishing scams relating to GDPR and attempting, at alarming rates, to persuade us to disclose our personal banking and other information.
The same advice applies in these circumstances as it does in all phishing scams. As Pennsylvania Attorney General Josh Shapiro suggests:
If you have any questions about GDPR or other cybersecurity matters, please reach out to me.