01
Customer PII exposure
Move inventories, ID copies, and credit-card-on-file routinely sit in shared drives and CRM exports. A single mailbox compromise exposes every customer record.
Industry · Moving · Customer-Data Protection
Cybersecurity for moving companies.
Moving companies hold a surprising amount of customer PII — addresses, payment on file, inventory photos, ID copies. EFROS hardens Microsoft 365, stops payment-redirection scams, manages the crew device fleet, and keeps backups tested before peak season.
Where the risk actually lives.
02
Payment redirection scam
An attacker poses as the moving company and sends customers fake payment instructions days before move-in. The deposit lands in the attacker's account.
03
Fake customer leads from typosquats
Lookalike domains harvest move requests and resell them to unrelated movers. You lose the lead and your reputation absorbs the fallout.
04
Ransomware during peak season
Summer is the worst possible time for a file-share encryption event. Dispatch, scheduling, and customer billing all freeze at once. Backups need to be tested before peak, not during.
05
Crew device loss
Crew leaders carry tablets with customer addresses, payment data, and inventory photos. Lost or stolen device + no MDM = direct customer-data exposure plus compliance reporting.
06
Phishing aimed at scheduling
Attackers know move dates are reschedulable. Phish targeting the scheduling team gets the highest open rate; one click compromises the scheduling mailbox and downstream customer communications.
What's included.
- Microsoft 365 hardening with focus on scheduling and accounts-receivable mailboxes
- DMARC enforcement to stop payment-redirection scams running from your domain
- MDM / mobile device management for crew tablets and phones
- Customer-data retention and disposal policy aligned to state privacy laws
- Backup of CRM, scheduling, accounting, and document repositories
- EDR on dispatch, scheduling, and accounting workstations
- Identity hardening — MFA, Conditional Access, privileged-role review
- Annual cybersecurity awareness training for office and crew leadership
- Cyber-insurance evidence pack for renewal and claims documentation
FAQ.
What happens to our customer data if we use EFROS?
Customer data stays in your tenants and CRM — EFROS does not retain custody. Access is read-only auditor or global-reader where the task allows; elevated access is time-boxed and logged. Sub-processors are disclosed under NDA.
We've had customers report fake payment emails. How fast can you stop that?
Phase one of the DMARC rollout (visibility, p=none) goes live in a week and shows you who is currently sending mail claiming to be from your domain. Phase two (quarantine, p=quarantine) is typically four weeks out. Phase three (p=reject) cuts the spoofed mail at the receiver before it reaches your customers.
Do you handle the crew tablet and phone fleet?
Yes. Microsoft Intune or Jamf for fleet provisioning, lost-device wipe, app management, and OS patch enforcement. Onboarding and offboarding are documented to four business hours.