Electronic scam costs business owner thousands

8 February 2019

Scammers regularly target small businesses and are often successful in their illegal dealings to defraud innocent parties.

Members should remain diligent and sceptical, informing staff immediately of any known scam. Additionally, new scams should be reported to ACCC so that they can alert the wider community.

As recently as this week, an automotive business was defrauded of a significant amount of money through a sophisticated scam that broke into their email, replicating a supplier.

Initially the business received the usual reminder from their genuine supplier advising that the December account balance was due. The business advised that payment would be made on the due date and received a courteous response. A subsequent email, which was actually from the scammer, then advised of a change in bank account details. The business ultimately made payment  – only to be contacted by their real supplier who advised that payment had not been received and that they had not changed bank account details.

The email the business received advising of the change in bank account appeared legitimate with correct logos and contact details and the new bank account details were printed on an attached PDF document with the supplier’s letterhead. The ‘new’ bank account was with the same bank as the genuine supplier.

Phishing emails are widespread today, luring businesses into divulging their login credentials, username and password through convincing emails and links to web pages.

Top tips to avoid being scammed:

• If an email seems suspicious do not trust it
• Be wary of clicking links in emails
• Verify a link’s legitimacy by checking that the URL address of the link is directing to a secure site – you’ll know this because the link address will begin with https:// whereas phishing fakes will often just have http with no ‘s’
• Look at the domain of the URL address and check it is directing to a legitimate domain owned by the supplier
• If in doubt, make a phone call to the supplier to verify the email is real