Counterfeit clients: How to spot bank transfer fraud
26 November 2018
Bank transfer fraud – or authorised push payment fraud – is on the rise, and advisers are sometimes acting on bogus client instructions…
We first highlighted bank transfer fraud back in 2016 and, since then, the risk has grown for many individuals and businesses.
In fact, in the first six months of 2018, victims lost £145m to the fraud, and only £1 in every £5, on average, is recovered.
Here we look at the increasing threat and growing cost of this fraud, and the vital role you play in helping to protect clients, and yourself, from becoming victims.
It’s happening now…
Between January and June 2018, there were approximately 34,000 cases of bank transfer fraud in the UK. Losses were around £1m per day, with an average loss of £4,260.
As a result, this type of fraud has been gaining attention within financial services, consumer groups, law enforcement, the media, and even with politicians.
Hacking has led to attempts to withdraw money from Zurich customer investments and, in a number of cases, advisers have acted on bogus instructions.
How it works
Typically, criminals gain access to a user’s email account, most commonly through methods such as hacking, phishing (and other social engineering techniques), and Malware. The unauthorised access could be to your company email account or to that of your client – cyber criminals are not fussy.
They then use the information they’ve accessed to commit fraud and other crime. For example, by establishing the business relationships and assets an individual has, impersonating them, and requesting encashment of assets.
Usually payment is requested to a new bank account controlled by the fraudsters, and is swiftly transferred on and becomes irrecoverable.
Factors
There are a few factors which can facilitate the fraud.
Emails sent by the criminals may come from the victim’s genuine email account, or an amended email address intended to deceive the recipient that it is from the victim's genuine email account, making the fraud difficult to detect.
Criminals can also prevent genuine emails reaching the victim, who consequently could be unaware of any problem until it is too late.
Where genuine payment requests are intercepted, sometimes the only change criminals make is to the bank account details quoted in the email trail, meaning the usual red flags (e.g. the language used in/style of an email) might not be visible.
Additionally, in order to provide a quicker service for clients, processes aren’t followed. This can sometimes mean that anti-fraud controls aren’t implemented.
What you can do
As the saying goes: ‘prevention is better than cure’, and financial advisers are at the forefront of fraud prevention.
Our tips below explain the action you can take to prevent, and if necessary respond to, this type of fraud.
The most effective – yet simple – fraud control we’ve identified is to call your client when you receive a payment request and change of bank details solely by email. Using this approach will help to prevent you and your clients from becoming victims.