Keylogger

A keylogger is a program that records every key someone types on a computer, out of sight. It does not slow the machine down and opens no window, so nothing on screen tells you it is there. It keeps a list of what was typed and sends it to whoever installed it. The bank password, the email password and the card number a customer reads out over the phone all end up in the same file.

The computer most at risk is the shared one in the back office, because nobody owns it and everybody uses it. The manager checks the bank on it in the morning, a supplier plugs a USB stick in at noon, and a part-timer browses on it at night. With that many hands on one keyboard, that is where these programs usually end up.

They get in three common ways. The first is an attachment that claims to be an invoice and gets opened without a thought. The second is a free program to convert a file, or a cracked copy of paid software, which brings the recorder with it. The third needs no download, because someone with ten minutes alone can plug a small device in between the keyboard cable and the tower, which no antivirus can see because it is not software.

The signs are quiet, and that is the point. Typing feels delayed, the mouse pointer stutters as you enter a password, and a browser asks you to sign in again on a site you never signed out of. Money leaves the account in small amounts first, because whoever is watching tests the limit before taking more. So if a member of staff says their email is sending messages they never wrote, suspect the back-office computer before the phone. When Linkysoft is called in after money has gone missing, that machine is where we look first.

Cleaning one machine is not the fix. Change every password from a different device, turn on the code-by-phone step for the bank and the email, and check the back of the tower for anything you do not recognise. Then get rid of the shared login, because that habit is where the problem grew. Linkysoft asks about that shared computer in the first hour of a security review, since it is where most small businesses lose money. Giving each person an account of their own inside a proper business system costs less than one stolen transfer.