Bank of Ireland warns about potential Brexit-themed business fraud

As Brexit uncertainty continues and businesses prepare for change from December 31st, Bank of Ireland is advising businesses to be on increased alert against fraudsters capitalising on vulnerability during this period. The Bank is advising businesses to be on high alert to the practice of business email compromise, where a company’s email is compromised resulting in a range of types of financial fraud including ‘invoice redirection’ and ‘CEO fraud’. Businesses are urged to treat any requests to change bank account details or transfer funds with extreme caution, and, as a matter of course, to verbally check any such requests with a known contact at a known number every time.

In the second half of 2020 a business email fraud ‘near-miss’ was intercepted by the Bank of Ireland fraud team along with An Garda Síochána and funds to a value of €2.1M were recovered. Another business was on the brink of losing €1.1m when their emails were compromised in an attempted fraud but, due to the actions of the bank’s fraud teams, the majority of the funds were recovered. While average values of these frauds are lower, it is a persistent problem with the bank’s fraud teams acting on reports of two to three cases of this type of fraud per week.

Invoice Redirection fraud is where fraudsters pretend to be a supplier or service provider in order to trick employees into changing bank account payee details. A common tactic is to tell the business that their bank account details have changed and for all payments to be sent to a new account, controlled by the fraudster.

What to look out for:

  • The fraudsters may write to a company’s finance or payments department either on forged headed paper or by email, pretending to be a supplier.
  • Typically, they will tell the business that their account details have changed.
  • The payee account may be located either in Ireland or overseas.
  • The fraudster may ask an employee to either send a pending payment to the new account or, alternatively, to ensure that all future payments are sent to the new account.

CEO impersonation fraud, is a type of fraud where the fraudster pretends to be a senior executive from the victim’s organisation. An email is sent to an employee to try to trick them into doing something, like making a payment to either an existing or new client or supplier.

What to look out for:

  • The fraudster will try to pressurise a member of staff into acting quickly and without thinking.
  • The fake emails are well crafted, can be sent from compromised email accounts and may look like they have come from a senior executive at the company in question.
  • Typically, the fraudster instructs the staff member to make an urgent high value payment to a supplier or creditor, and usually includes the payee details, including the IBAN.
  • Often the payee account is located overseas.

Edel McDermott, Head of Fraud at Bank of Ireland commented: “We know that fraudsters thrive in periods of change or uncertainty for business, where attention may be focussed on other priorities. Brexit will bring considerable change to many companies, including new procedures relating to customs or changes in arrangements with vendors or customers. Business email fraud at any time has the potential to have a devastating impact on business. We are urging business not to drop their guard against email scams over the coming period. Training staff on the warning signs and the basic steps to take will safeguard business against these avoidable losses. If every business followed a simple step that a request to change account details or to make a payment was always verbally checked with a known contact, at a known phone number, the majority of this type of fraud would be stopped.”

Bank of Ireland’s advice to business:

  • Be skeptical of urgent requests that do not follow typical company procedures and policies.
  • Establish a documented internal process for requesting and authorising all payments. You may need to review existing internal procedures.
  • Consider how your business issues and accepts payment instructions. Email is not considered a secure means of communication unless encrypted.
  • Always verify that the email is from the real sender. Phone numbers quoted in the suspicious email should not be trusted; verify the contact internally or at a known phone number, before making any payment.
  • Under no circumstances should contact details contained in the email or attachments be relied upon to verify the request whether these consist of a physical address, an email address or a phone number.
  • Notify the Bank immediately if you receive a suspicious email relating to payments or if you think you have been the victim of fraud. The sooner customers notify Bank of Ireland the better the chance of tracing and recovering funds.

Visit /security-zone/protect-your-business/ for examples of business fraud and for advice on how to protect your business.

Bank of Ireland is committed to building awareness around fraud. Bank of Ireland will continue to focus on the issues around fraud, through the Bank’s own channels and by working collaboratively through the Bank and Payments Federation of Ireland (BPFI) FraudSMART campaign www.fraudsmart.ie.