Featuring Eric K. Mensah
Is your digital marketing business truly safe online? 🔐In this episode of Colours of Social Media, Enoch "RobotBoy" Appiah Jr. sits down with Eric K. Mensah — a Cybersecurity and Financial Crimes Specialist — to talk about the cybersecurity threats that digital marketers in Africa and beyond are most vulnerable to, and exactly what you can do to protect yourself and your clients.
[0:00] In Ghana right now, accounts are being taken over, and many businesses never recover. From Bildx Studios, this is Colours of Social Media podcast.
[0:11] I'm Enoch, RobotBoy Appiah Jr., and in this episode, you are going to learn how to stay protected in an era of increasing cyber threats as a digital marketer.
[0:22] I'm joined by Eric K. K. Mensah, a cyber security and financial crime specialist, and also the co-founder of MentorUs Africa. Now in this conversation, Eric will break down practical cyber security best practices every marketer should know, from securing your ad accounts to avoiding common traps that leads to hacks. So Eric, thank you so much for joining me on Colours of Social Media. Thank you so much too for inviting me.
[0:58] Awesome. Now before we start our conversation, I just want to read to you a message I got on LinkedIn. I think that will be the basis of this conversation, right? Yeah. So I'm just going to run through real quick, then we start this conversation with that. Hello, I'm not going to mention the person's name because he has since apologized. So hello, I'm Kwaku Mensah from a professional service firm within the global network of international. You can learn more about us on our website, and the website is actually a website. I went there, it's a genuine website, just to put it out there. We offer, just as the website said, they offer the same services.
[1:44] I've just reviewed your profile, that is my profile on LinkedIn. And after reviewing your CV, which I haven't sent in my seat, I believe you're a great fit for the exciting opportunity we are offering. This opportunity includes flexible working hours, which you all love.
[2:05] Remote work on creative and marketing projects with an attractive salary. Potential for long-term collaboration with clients across various industries. If you're interested, please see our project details in the attached PDF below. Fill in your information and leave us a message. So this person went ahead to send me a Google forms link, which when you click on it, it will send you to Google forms for you to fill out the details. Then I went through the process, right? So at the end, I got a linked one, a file with an extension of exe. So in this case, from your own asset, cyber security specialist, right? What should I do? So when you are reading, I just started laughing because these are typical schemes that criminals or fraudsters do, right? They used to get unsuspecting individuals. Of course, you know that the unemployment rate is very high across the globe. In fact, even in Ghana here, a lot of people are looking for employment. And like you saw the message, it was carefully crafted.
[3:27] However, you see anytime criminals are crafting their messages, because they intend to blast it to a lot of people, uniquely to you, you might see that there is an element in there that does not really match. For example, you didn't send your CV to them. That is one. But they are saying that the CV value sends to them and they've reviewed it and all that. So that is straightforward, a red flag. Now, when you look at the modus operandi, so modus operandi is basically their skin, the way they craft their modus, right? Or their act. They sent you to a Google form.
[4:07] And after that, you got a link to download a file that ends with .exe. That is an executable file. So those who don't understand, right? It's a file that once you click on it, it will store something on your machine. Okay. So the good thing here is that because I'm on Mac and our extension is DMG. So if I click, yes, that is the thing. So would you advise that marketers should switch? I will let you continue. But then would you advise that should marketers switch using only Mac in their work or they should still stick to their pieces?
[4:49] In fact, I would have been doing some marketing, but no marketing. The key thing is that the criminal can still develop a .dmg file to target jurisdictions that are Mac users. You get it.
[5:05] So the key thing is that any time you are downloading a file that is not your regular, you know, it's supposed to be a PDF or so. So it should be .dexe. But I see .exe. It means that it's a file that cannot execute. All you are seeing .dmg, which is tailored for Mac. So we ought to be very careful. Even you should ask yourself, the form I am filling, I am not supposed to have downloaded in an application to, you know, use for the application. So I'm using to as an application for yes. And then application for job. Right. So we have to be careful. Links that we click on. That is why the key thing is, and you hear this often, that if you get any unsolicited message, particularly having a link in there, never click on these links because you might be fished. Thank you. You've mentioned fished when you come to that. But in talking about unsolicited messages or emails, can I prevent myself from receiving these? And if I can, how do I go about preventing people from just sending me these kind of messages? Yeah, it's quite a tricky thing, right? And so I look at it from two angles. One is your email address. A lot of us have call cards, complimentary cards. Because we want prospects, we really go share our complimentary cards that have our emails in there. So your personal email or so are in there.
[6:47] The criminal can even still, there are portals that are available. I know where you work, their domain. I try to get to know how your company crafts your emails. Some people first name and then at their domain or first name, last name, that kind of thing. So the criminal can even still target your organization and then have those combinations because you may know the list of people that work in your organization. That is one bit. The other bit is receiving it in your inbox. If it is like social media, like LinkedIn, that one you can prevent it from hitting your inbox. But for a corporate email address, that is where the organization needs to have spam filters.
[7:37] Because usually when these criminals are blasting these messages, they blast it back. So there are certain rules that you set in your spam filtering system to identify keywords and then it will put it in the junk for you. So organizations that are listening, this is what you need to do.
[7:59] Have very good spam filters and have your IT guys regularly update their rules and all those conditions with it so that some of these random messages will not hit your organization. And who knows, maybe another intent or a new staff that you've recruited will mistakenly click on it.
[8:20] I'm a marketer. Eric, why should I care about security? You see, when it comes to digital marketing, your key thing is you're out there, right?
[8:32] But you know that your door to every platform is your login, right? So if you lose your login, you are gone. Your reputation is gone. Money is gone because you might be handling big contracts. Even trusts that you have built over the years because you can attest, you have been in this job for quite some time now, right? People take time to build reputation online.
[9:06] You build and you get 500k followers. You have sometimes 1 million followers. And all of a sudden, your account has been hacked. Yeah, it has been taken over. You can imagine the big blow it will be, even if it is a very big corporate organization that is well known. So when it comes to digital marketing and cybersecurity, it is a non-negotiable. It is a business imperative.
[9:37] You have to be well equipped to protect your accounts that you manage, your other accounts. You know, a lot of digital marketers, very big ones, they manage a lot of accounts.
[9:51] A lot of money. Exactly. So imagine that your email address or your email account is hacked and someone just does a recover password or forgot password and your password goes, OTP goes there and they hijack all your accounts. See how big it is. That is why security and digital marketing will go hand in hand to protect your assets that you put over the years. From your experience, let's stay on account takeover in Ghana. How serious is account takeover in Ghana now? In fact, it is really serious. In fact, the statistics show that I can even give complex examples, but see the fact now also is that even the reports that are given online in certain portals, I would say they are underreported from analysis. Underreported. Exactly. Because you just take WhatsApp takeover, for example. A lot of people have been taken over. Some people report to Ghana Civil Security Authority. Some people report to the portals that they are working on.
[11:10] But a lot of the people who have been taken over do not report. So it brings the numbers. Yes, the numbers are high, but it makes it a bit lower because not everybody reports. You get it. So account recoveries are huge. And like I was giving you the example where you have big social media marketer or digital marketer, right? Then your email that you cherish a lot, and that is what you use to assess all the accounts, has been compromised.
[11:46] Somebody takes over your email because that's the key to everything and then compromises. You realize that every account of yours will be compromised and you are gone.
[12:00] Sometimes when we report and report one, I have been compromised and it counts one. Only one account, not forgetting, not knowing that other platforms will also affect it.
[12:12] So seriously speaking, account recoveries are huge. And that is why even as the guitar marketer and even individuals watching, you ought to take best practices to be able to protect and secure your accounts from takeovers. You may mention that some people, if their accounts are taken over, they don't report. What are the processes involved in reporting that my other account has been taken over? Great. So there are different processes.
[12:49] Like I didn't mention, Ghana has set up a cybersecurity authority that has been instituted and they help organizations. So when you go to their website, even there is a number you can call 292 and then there are some emails that you can even send to them to help you. But most essentially, these platforms themselves have a way to report. So sometimes you go to...
[13:19] You mean the social media platforms, LinkedIn, So if your accounts have been taken over, you can even use other people's accounts. Let me just give you an example, WhatsApp. If your WhatsApp hasn't taken over, one of the ways to do is to talk to people who are curious to you. They go to, I think, settings or contact us, help, then you go to... what you need them to help you on. So your colleague would type in oh, the numbers are compromised and it's being used by criminals for fraudulent activities, you know, that kind of thing, right? So kindly help out. So once you have your colleague make that report, they have a system that they use to monitor this report, then they'll certainly attend to you. So maybe by four days time they block their criminal, by six, seven days time they'll reinstate, you know, those are the protocols that they put into. So every platform with avenues that they have for you to report. If you don't have the knowledge on that, you can speak to people who are in the domain to help you out.
[14:31] So let's stick to, I mean, let's take this WhatsApp scenario. You said maybe roughly for this time they'll get your account reinstated. But truth be told, before that four days comes, the harm has already been done. Exactly, exactly. Yeah. So my next question will be, how should marketers prevent themselves from being hacked in the first place?
[14:58] Great. So like I did mention earlier, right, your key for now is your login credentials. That's right. Your login username and your password. Now, one of the key things that you should not, and if you don't have that, after watching this episode, please do that now.
[15:20] Okay. Okay. It's multi-factor authentication. Multi-factor authentication. Or 2FA. So there are two names, multi-factor authentication, two-factor authentication. They all mean, I will say they all mean the same thing, but they all arrive at the same thing. So multi means that for you to authenticate yourself before you get onto a platform. Let's break the authentication. We are marketers here. So for you to tell the system that this is really me.
[15:56] The platform. The platform, right? That this is really me and allow me to go into the account. Instead of just username and password, I have a phone. Send me an SMS to be able, which is the OTP, the one-time password. One-time password. OTP. So send it to me. So that once I input that password or the code or six degree code, sometimes what they get code into your platform.
[16:29] Allow me in. So in this case, you are not only using your username and password to login, but you're using username, password, and the OTP. Exactly. Genius. You get it. So the criminal can have your username and password. Yeah. But without the code. Exactly. So physical device.
[16:52] Okay. You get the whole thing. So that is very key. But even because of the way the world is advancing, criminals have actually developed ways and needs to even dive. Yes. So right now, the very best practice is to use an authenticator. Authenticator. Authenticator. So when you go to App Store or iOS, you have the Google Authenticator. Yeah. I use the Google Authenticator. Good. Yeah.
[17:24] You get it. There is the Microsoft Authenticator. There are a lot of authenticators out there, right? Try to use them because that one, it is app-based. So you get a code randomly generated in the app. And after some seconds, the code changes. Yeah. So that is very more, it's much secured, right? To be able to do that. When you let the OTP go into your email again, and they have access to the email, we are about to square one. Exactly. They will just use the OTP from the email and then get in. And you know the funny thing, most of us use the same password for multiple accounts. Yeah. That is very, very bad. Maybe I'll talk about that. Yeah. Yes.
[18:13] So that is one key thing. Another thing to do to protect yourself as a digital marketer is use a password manager. Password manager. So password manager is like a vault, right?
[18:24] Where all your passwords are dumped into the vault, then you lock it with the master kit, right? Yes. Of course, there's some school of thoughts. We say, hey, so what if that master kit? Yeah, that's about right. Exactly. That is why you have to make that master kit very robust.
[18:46] You don't have your password to be marketing 2026 as your password. 2027. Then you change the market. You change the change in the years. That will make you vulnerable, right? So like I'm talking about passwords, you have your Affirmary, special characters, all those things, right? To help protect you. At least 12 characters, that should be able to help you out, right? So I've mentioned having a multi-factor authentication or 2FA, also having a password manager to help you out. The other thing is you need to also sometimes use a VPN. That's our private network, particularly if you are using public Wi-Fi.
[19:34] So in a sense that if you go to, let's say a coffee shop to work, if you go to an internet cafe to work, you use, you switch on your VPN. Because you don't know who is managing that public Wi-Fi, right? You don't know who is at the back end of that cafe shop. Maybe they can be sniffing the network and you'll get to see a lot of things that you are doing. So as a digital marketer, you have to get a VPN on your phone and on your laptop. There are a lot of them put on the VPN. Which one would you recommend?
[20:13] Oh, so not to advertise. Of course, there is the put on VPN. Of course, the VPNs, there are free ones and they are paid ones. You know free ones, you might not have access to all the features, right? If you have some small dollars and CDs to spend, you can get the paid ones, right?
[20:32] You go to your app store. When you go to app store, you can even check. You can type VPNs, right? In your app store and you see a lot of them on the app store and then you go to them. So that is what to do for the VPN level, right? So I've mentioned at least about four now, right?
[20:52] Eric, for the purpose of this conversation, right? And you may mention VPN. Some are free, others are paid. Now for the free one, can they at least sort of protect us when we work in the public sessions? So the free ones can help you to the minimum. At least the basic help it will do.
[21:19] Protecting you when you are using public Wi-Fi. Thank you. Right. But if you want additional features to make it very robust, you need to get that. Like I've mentioned that VPN also get an antivirus on your device. So all of us know that it's your laptop that needs antivirus. But your phones also need today. Most of our digital marketers use our phones for a lot of things.
[21:46] So you need an antivirus. So for example, a malware bite can help you out, right? So it helps after antivirus and also anti-malware. So malware, for example, you click on that.ESE file.
[22:00] The file at the top of the piece. Malware bite will just quarantine. Maybe this is a malicious app. They will quarantine for you. Let's move from an individual marketer to an agency setting. What should agency do if they have multiple people managing one an account? Yeah. So you see, when it comes to agencies and I've heard a lot of people talk about this where they share passwords. Yeah. Oh, a new stuff have come. They need to pull out this report and then do ABC. Oh, share their password.
[22:42] And you just type their password and share it by WhatsApp or you take it right on the piece of person. It is a very bad practice. In fact, the platforms themselves, like the meta business suits and all those things, right? They have role-based features in the apps. Yeah. So yes, the admin or the master person or the manager has an admin role. Right. Yeah. All right. An intent has come in.
[23:12] What is the role of the intent? The intent just has to post content online. Yeah. You get it. True. So then you'll give in the system, you just give the intended role. Content.
[23:23] Content. Interesting. Yeah, that's it. You get it. So that intent cannot do a lot of crazy stuff on the application. And it also helps so that if something goes wrong, you can attribute it to a buddy to solve the situation. Exactly. So for agency settings, that is a key thing to do.
[23:48] You don't also share because when you do the role-based thing like that, you don't need to share password. Yeah. You only ask, okay, what is your account on LinkedIn? What's your account on Facebook? I want to make you a content manager or a reviewer or financial, that kind of thing.
[24:03] Then the admin would just want to pick it up. Another thing within the content or the agency settings, most of the agencies forget that they've given some rights to people when they leave the competition. Yeah. So someone comes to do two months, three months internship, you give them the right, the content, even without content manager. Right. They leave and you forget to revoke the rights. What happens if the person becomes disgruntled? Maybe during the work.
[24:39] He goes rogue. So as agencies, you need to have a protocol. On-boarding and off-boarding protocol. Yeah. Someone comes in. These are the processes we want to bring you on board. Okay. We give them right. One, two, three. Even intern, whether intern, full-time, part-time. Yes. Because sometimes you get somebody to come in to do some six month project. You are doing a campaign and it's a very big campaign. So you bring your consultants and you give them those assets. When they are done, you don't have to trust them. Of course. Trust itself must be verified. Yeah. So you need to have those on-boarding and off-boarding. Once the assets that you need to go and revoke. Right. So that is a very critical thing. And I would overemphasize this training. Once somebody comes on board, right, all the trainings we are having here in this episode, your digital market test must go through this training. So in a very proper setting, the digital marketing team must have a budget for training because the models keep changing every time. The industry is dying. Now there's the fake there is AI generated. I tell you, if you are not super smart or you are not very careful, the criminal gets you. Yeah. So training is also very important for the agency.
[26:22] Then, like I did mention, the other things still apply. The antiviruses, the anti-malwares, and all those things are very important. Let's talk about, I mean, mention at least, or at most, let's do at most, at most free non-negotiable things you will advise agency to do. Great.
[26:50] The 2FA. 2FA. Or the MFA. It's a non-negotiable. Non-negotiable. Everybody must, as long as you're on their account, you should have your 2FA or an MFA setup. And when you have it to pass by policy, you can tell them the first to go is the authenticator.
[27:12] If the platform does not allow authenticator, then now you go to SPS. Ah. You get it. So you can tier it. Yeah. Okay. Yes, 2FA, it is non-negotiable. When you are doing it, it should go to an authenticator app.
[27:28] If the platform does not allow authenticator app, then you do SMS. SMS. No email. No email. No email. Interesting. So right now, email is becoming obsolete when it comes to security.
[27:42] Because once your email is compromised, you are born. Charlie. Charlie. You are gone. So that is one key thing for agencies to do. Like I did mention in the previous question, you should have onboarding and onboarding protocols in place as agencies.
[28:01] This is non-negotiable. Then the other bit is having sufficient budget for training and retraining for your staff. So we haven't done this in any of our episodes before, and you are the first. So we're going to switch our conversation to rapid fire session. Okay.
[28:23] Actually, one pound. You give me one answer. You give me one answer. You give me one answer. This is the first time. Let's see how Eric does it. I hope that works.
[28:33] All right. Let's start. Okay. So what's one red flag that screams, this is scam. When it is urgent and it comes with authority. Great. Password manager or no password manager. Password manager.
[28:46] Public Wi-Fi. Is it safe or risky? It is risky. Public Wi-Fi. Yes, risky. One thing marketers should stop doing immediately. Like the moment they finish watching this episode, one thing they should stop doing. Stop clicking on any and every link from unsolicited sites or messages. All right.
[29:07] Yeah. Eric, Eric, Eric. I got to talk already, right? Yes, yes, yes, yes, yes, yes. All right. So we are about to wrap up this episode. I want to know, what's one final piece of advice you give to anyone managing a brand online today?
[29:25] Okay. So my final piece, right? Maybe I should have mentioned this earlier, but it's not too late. I'll just mention it, right? Yeah. Most of us have logins or plug-ins to some sites because at the guitar marketers, we use plug-ins to, you know, get keywords, a whole lot of, if you look at my, not to catch you, but if you look at my browser, I have a lot of plug-ins. Thank you. Yeah. You should be very careful. Okay.
[29:54] Always get plug-ins from reputable sources, right? Because some plug-ins can be malicious, right? Always get the plug-ins from reputable sources. If there is an update for any plug-in, please do well to update it so that you don't end up making yourself vulnerable.
[30:15] Beyond your work, I mean, you are a cybersecurity expert. So if you come to work, clearly you'll be doing that angle, but then beyond your work, what drives the passion to, you know, build a safer online in Africa? Yeah. You see, I have done this for several years now, right?
[30:36] And I realized that everything is going digital, right? Now, on the other hand, there are a lot of people going to school because they know that everything is going digital and it needs to be all protected. That actually gave birth to mentors Africa. I have heard a lot of people contact me for mentorship and it is so big. So the whole dream is people contact us as mentors Africa. We have connections with astute professionals within the space. So cyber security, astute intelligence, compliance and financial crimes. We link them to them. We link the mentees to the mentors for them to mentor them. Because whether we like it or yes, whether the world likes it or yes, Africa is the next big thing coming. Yes. The beautiful population is huge.
[31:35] So we need to build the foundation. And this is where mentors Africa and the passion to educate people to make their continent cyber resilient comes from. If someone wants for that advice on cyber security, how can the person contact you? Good. So on a personal note, I am on LinkedIn.
[31:59] The Kwaku is K-W-A-K-U. K-W-A-K-U. You can link up with me on LinkedIn. I also have the mentors Africa and the co-founder of mentors Africa can go to our website. We can also reach out on social media, Instagram and then LinkedIn. We are super active on LinkedIn because we believe that's where a lot of the professionals are. So that we can do a lot of things. So that is who I am. You can reach out to me for advice, for support, for a lot of things.
[32:33] Awesome. Thank you so much. And of course, I reached out to you. That's why you came. Yeah, I appreciate your presence and thank you for coming on. Thank you too. The conversation was truly insightful. I've learned a thing or two from you. And I hope you too, you learned something.
[32:50] Thank you, Eric. And thank you for watching this episode. If this is your first time of watching an episode of Color Social Show, please do well to subscribe so that you don't miss our subsequent episodes. And if you've already subscribed, do kindly share this episode with your network. That is the only way to support this show. Thank you and see you at the same time.