Two of our clients have been contacted via email and asked to make payment transfers. In one case, a payment transfer was made and is currently being investigated by the police.
What makes this one different from other email scams is that research on the businesses in question must have been carried out. In one case, the email was sent to the financial controller. Both emails made reference to the name of each company’s managing director.
The emails ask for money to be transferred urgently. Most worryingly, when a member of staff replied to the email and asked for further information, they actually received a response.
In both instances, while the email address was not correct, the managing director’s name appeared correctly in the Display Name. An example of one of the emails is below. (We’ve changed the name of the recipient to protect their privacy).
– – – – – – – – – – – – – – – – – – – – – – – – – – –
From: John Smith [mailto:JohnSmith89@yahoo.com]
Sent: 23 June 2015 10:19
To: Andrew Anyperson
Subject: TRANSFER REQUEST
Did you received my previous message I sent this morning concerning the urgent transfer you need to make, if not let me know so I can resend.
John Smith
– – – – – – – – – – – – – – – – – – – – – – – – – – –
We recommend that you check the ‘To’ email address and not just rely on the Display Name as part of the process of judging the authenticity of emails. In addition, we recommend that you implement a payment authorisation process that does not involve email. For example, via a telephone call or text message to a known number.
If this is not possible, a safe word or secret phrase to be agreed in person with your clients and suppliers beforehand. Then used within emails can help to ensure the email is valid.
UPDATE
On Friday 3 July, the Wiltshire Times published a story about a man in Trowbridge who was targeted by a telephone version of the scam outlined above.
If you are unsure about the authenticity of an email, just forward it to support@priorityit.co.uk and we will check it for you.