October is Cybersecurity Awareness Month, and this year the National Cybersecurity Alliance chose a theme that resonates particularly strongly for fraud professionals. As CFEs, we know how important good preventive controls are to prevent fraud losses either in our organizations or our personal life. An ounce of prevention is worth a pound of cure, and it is much easier (and significantly less costly!) to deter fraud from happening than to investigate it after the damage has largely been done. After all, opportunity is sometimes the only leg of the Fraud Triangle we can consistently have an impact on. The National Cybersecurity Alliance encourages all of us to make life difficult for cybercriminals by taking small actions that can make a big difference. Before Cybersecurity Awareness Month officially closes out, let's take a look at some of the tips on how we can prevent cybercrime from happening, and talk about how those actions can also be incorporated into how we spread awareness of and prevent fraud.
Tip 1: Use strong passwords and a password manager
The NCA's first step is to use long, unique passwords and let a password manager keep track of them. A reused password is a gift to fraudsters – if the password is compromised on one site criminals can try it everywhere else, leading to account takeovers.
There is a less obvious fraud benefit, too. A password manager fills in your login only on the real website it saved it for. If a phishing link sends you to a look-alike domain or a spoofed website, your password manager won’t give away your password even if you might have otherwise been fooled! A good site to check if your email may have been involved in a data breach is www.haveibeenpwned.com.
The fraud connection: Look-alike names are an old fraud trick, not just a cyber one. Embezzlers have long set up shell vendors with names nearly identical to a legitimate supplier, counting on approvers not to look closely. Always verify!
Tip 2: Turn on multifactor authentication
Multifactor authentication (MFA) means a stolen password alone isn't enough to get into an account. It is one of the most effective protections available, and it should be turned on for email, banking and social media at a minimum.
But fraudsters have adapted. If they can't steal the second factor, they’ll try and talk the victim into handing it over. In November 2025, the FBI warned that criminals posed as bank employees, customer support and/or fraud investigators to convince people into giving up their login credentials and one-time passcodes. With those in hand, they could reset the password, lock out the real owner and move the money away from the legitimate account. The FBI counted more than 5,100 complaints and over $262 million in losses from these account takeover schemes in 2025.
The fraud connection: MFA is a strong control, but social engineering targets the person, not the technology. The message to share with family, colleagues and clients is simple: a one-time code is as good as cash. No legitimate bank, employer or government agency will call you and ask you to read it back to them. If someone does, hang up and call the institution yourself using a number you already trust.
Tip 3: Recognize and report scams
As CFEs, we tend to be very familiar with this one. The Federal Trade Commission received 3 million fraud reports in 2025, with consumers reporting $15.9 billion in losses. Imposter scams were the most-reported type, at more than $3.5 billion.
Recognize. Nearly every scam relies on urgency. A fake security alert from your bank, a call claiming your computer has been hacked, a message saying a family member is in trouble are all designed to make you act before you think. The single most effective habit is to slow down.
Report. Reports are how investigators and regulators spot trends and connect cases. Consumers can report fraud to the FTC at ReportFraud.ftc.gov and cyber-enabled crime to the FBI at ic3.gov. One caution: in July 2026, the FBI warned that scammers are impersonating IC3 staff, including with AI-generated videos of FBI officials, to target people who have already been defrauded. Type ic3.gov directly into your browser, and remember that IC3 will never contact you by phone, email or social media.
The fraud connection: Encouraging people to report is something CFEs already understand. A culture where employees feel safe reporting a suspicious email is the same culture that supports an effective whistleblower hotline.
Tip 4: Update your software (and your controls)
Software updates close the holes attackers have already found. Turning on automatic updates for your devices, browsers and apps is one of the easiest ways to stay ahead of them.
Fraud controls need updates too. In Lying for Money, Dan Davies describes how fraudsters test a system with a scattering of attempts, learn which ones get through, then repeat the winners at scale. Any control that never changes eventually becomes a map of how to get around it.
A recent federal case shows what is at stake. In November 2025, a Nigerian national was sentenced to 21 months in federal prison for a business email compromise scheme against a small business in Indiana. His co-conspirators broke into a company's email account and used it to tell another local business that its bank had changed to redirect more than $182,000 in payments. The owners, both approaching retirement, had to refinance property and postpone their retirement to keep the business afloat.
The fraud connection: The email came from a real, compromised account, so it looked legitimate. What stops this scheme is a process, not a filter: confirming any change to payment instructions by calling the vendor at a number already on file. Like software, these procedures need regular review, so they keep pace with how fraudsters are getting around them.
Bonus tip: Set up a safe word
Alongside this year's theme, the NCA is promoting another simple habit: agree on a safe word. It is a code word or phrase known only to you and a trusted group, which you ask for whenever an urgent call or message arrives. According to the NCA, scammers need 15 seconds or less of someone's audio or video to create a convincing fake.
That makes the safe word one of the best defenses against AI voice cloning and deepfake scams, such as a "grandchild" calling in a panic for bail money, or a "boss" urgently asking for a wire transfer. The NCA recommends safe words not only for families and elderly relatives, but also for coworkers handling financial transactions.
The fraud connection: A safe word is out-of-band verification, the same principle behind a callback procedure for payment changes. When a voice or video can be faked, verifying through a second, trusted channel is what protects the money.
Don't make it easy for them, all year long
None of these steps are complicated, and that is the point. Fraudsters, like cybercriminals, tend to go after the easiest target. Every habit that adds a little friction (a unique password, a code that never gets shared, a pause before acting, a callback before paying) reduces the risk.
As CFEs, we are well placed to carry this message beyond October. Share these tips with your colleagues, clients and family, especially older relatives who are frequent targets. The NCA also offers a free Cybersecurity Awareness Month toolkit, with tip sheets and social media graphics, at staysafeonline.org.
And with International Fraud Awareness Week coming up in just a few days in November, there's no better time to get involved with the ACFE Pacific Northwest Chapter. Follow us on social media, join us at an upcoming event, and help us make life difficult for fraudsters all year round. We have 3 exciting speakers already lined up for our Lunch and Learns that week, and we can’t wait to tell you more about them in our next blog post.
Sources
