Get hacked or 'vished' and lose a fortune

There are currently so many examples of this it seems best to put the examples in one thread rather than post them up individually.

'Vishing' tends to be a unique UK problem caused by a peculiarity in our telephone landline network that enables a caller to retain control of your line for a short time after an inward call is terminated. About five years ago telephone companies promised to address this problem but nothing has happened.

Hacking is widespread and the risks are not fully recognised by many companies. Considering that I see many major UK car company accounts hacked on the scam vehicle advert section it is amazing that I haven't come across any examples of them having their bank accounts cleared out. Many of these companies have their advert accounts and websites linked giving any fraudster the ability to impersonate them and intercept financial information. How this information can be used will be seen from the following examples.

http://www.bbc.co.uk/news/business-34425717

2 October 2015

A solicitor has told the BBC that being tricked into transferring £750,000 of client money to criminals has left her life in ruins.

Sole practitioner Karen Mackie has been suspended from working, declared bankrupt, and faces the prospect of losing her home.

http://www.lawgazette.co.uk/practice/firms-losing-millions-to-phone-fraudsters-insurer/5051214.article?

25 September 2015

Three firms have between them lost £2.5m to phone fraudsters in recent months, an insurer said today - warning that this represents only a small part of an epidemic of crime.

http://business-reporter.co.uk/2015/09/21/average-cost-of-cyber-breaches-is-551000-for-enterprises-says-kaspersky/?

21st September 2015

The average budget required to recover from a security breach is $551,000 for enterprises, and $38,000 for small and medium businesses, according to a report by Kaspersky Lab.

https://www.energyvoice.com/oilandgas/88626/watch-out-for-supply-chain-fraudsters-kpmg-warns/?

25/09/2015

Oil and gas supply chain firms are being urged to be vigilant after evidence of a growing number of fraudsters trying to exploit online payment processing systems.

KPMG said it had seen a rise in the number of businesses being targeted by criminals seeking to substitute their own bank details for those of genuine companies.

http://www.express.co.uk/finance/city/606810/suffolk-business-conned-1m-biggest-ever-phone-banking-scam

Sep 21, 2015

Warning as business conned out of £1m in biggest ever phone banking scam

Business owners are being warned about the phone banking scams and the methods used to net cash, which have so far largely targeted the elderly and vulnerable to hand over their life savings.

Suffolk Police and Crime Commissioner Tim Passmore said: "I'm absolutely flabbergasted about the audacity of these criminals.

"I can fully understand how this crime took place and the damage to this company is potentially huge and it stands as a salient reminder that businesses too are victims of crime."

He added that the crime is "perhaps the biggest threat society faced"

Another couple of reports of losses due to alleged hacking incidents

http://www.dailymail.co.uk/news/article-3254528/Airbnb-stay-holiday-hell-photographer-taking-friend-Amsterdam-21st-birthday-treat-ends-defrauded-500-staying-dirty-apartment-falling-victim-online-hackers.html

A celebratory birthday trip to Amsterdam turned into the holiday from hell for three friends after an Airbnb booking led to them being scammed out of more than £500.

And even after they arrived home, their ordeal was far from over as fraudsters then hacked Miss Dudley's Airbnb and email account, and started using her profile to advertise bogus listings on the accommodation website.

http://www.theregister.co.uk/2015/10/01/uber_china/

Chinese fraudsters hitch a ride on Uber accounts

Uber accounts of US-based customers are apparently being fraudulently abused in China.

Kirby Bittner was one of a number of users to complain to Uber late last month about fraudulent fares in China. She, along with others, blamed account hacking.

Anecdotal evidence suggests that the latest problem with compromised Uber accounts may be more than a flash in the pan. Online security site Hack Read reports that in one recent case 500,000 pwned Uber accounts were offered for sale through dark web markets for £10 each.

That was then and this is now. Vice reports that active Uber accounts now fetch as little as 40 cents a pop.

http://www.bbc.co.uk/news/uk-northern-ireland-34506599

12 October 2015

Single mother loses £76k to fraudsters posing as solicitors

On BBC Radio Ulster's Nolan Show, Amanda Jackson said her life has fallen apart after fraudsters targeted her as she prepared to close on a house sale.

Ms Jackson was looking forward to starting a new chapter of her life by selling her former marital home and purchasing another property for her young family.
She was due to close on the sale on Friday, October 2.

On that day she was contacted via email by her solicitor's office to advise that the money was due and that she should transfer it into their Danske account, the details of which were provided.

However, a few hours later, Ms Jackson received a second email stating that the previous account details were wrong and that she should, instead, transfer it into a Barclays account, for which the number and sort code were listed.

However, this was a fraudulent account, which she only became aware of when her money failed to reach her lawyer's bank account on Monday.

Ms Jackson said she was "almost hysterical" when she realised what had happened. She was particularly shocked to learn that the name of an account holder is apparently irrelevant when making bank transfers.

"I naively thought that those details were married up and checked, certainly on a big transaction like that. But the account name means nothing apparently. So why do they ask you for it?

Whether you're a company or a private individual, if any account you use online is hacked you are at risk of being impersonated and having payments intercepted, and this is the standard response you'll get from the bank involved.

Barclays Bank, where the fraudulent account was set up, said: "We can confirm that in opening and managing accounts, we comply with all regulatory requirements, including in respect of identification and verification.

"We recognise that some consumers' interests have been damaged as a result of the conduct of some customers and that money has been lost.

"Regrettably, we are unable to provide any refund for individuals whose funds have been withdrawn from the account before we were made aware of the situation."

Barclays said there were no prior transactions on the account that would have led them to believe there was inappropriate activity and that Amanda's money was immediately removed from the account.

The result

Ms Jackson says she has felt sick with stress since she realised she had been scammed.

"I'm just helpless now. I've been to the banks, I've been to the police, I've been to my solicitor and everyone's just telling me 'Your money is gone'. I just cannot believe that I could lose this amount of money in this way. My life has just fallen apart."

Account opening procedures MUST be tightened up otherwise this is going to become a fraud epidemic.

Here we go again

http://www.getsurrey.co.uk/news/surrey-news/waverley-borough-council-hit-200000-10247153?

13 OCT 2015

Waverley Borough Council hit in £200,000 bank account fraud

The local authority said it had already got back some of the money and was working to try to recover the rest

A former employee has revealed that Waverley Borough Council put more than £200,000 into a fraudulent account after staff were duped into changing the payment details for a supplier.

A borough council spokesman said: “Waverley Borough Council can confirm that it was a victim of fraud.

"An investigation was immediately conducted which resulted in the recovery of a significant proportion of the funds.

“The council is continuing to work with the police, the banks and our insurance company to recover the outstanding amount.

Bear in mind that organisations don't like details of this type of fraud getting into the media but, when successful, it can be devastating.

More examples, this time when people lose money during a house sale.

You may only sell your house once in your life. Imagine finding that all the sale proceeds have been stolen.

http://www.telegraph.co.uk/finance/personalfinance/borrowing/mortgages/11943552/Why-wont-regulators-act-on-my-48500-property-fraud-loss.html

26 Oct 2015

'Why won't regulators act on my £48,500 property fraud loss?'

This couple lost a huge sum when emails to their solicitor were hacked.

Regulators say law firms have a duty to safeguard clients' money, but they're still waiting for their money back

Think you can't lose a lot of money ?

http://www.sleafordstandard.co.uk/news/local/fifteen-accused-of-12-million-fraud-1-7032149?

26 October 2015

Fifteen accused of £12 million fraud

Though there is no suggestion that hacking was involved, the point is that to pull off this type of fraud the criminal needs to know information about your or your company, and one of the simplest ways to do that is by hacking.

Fifteen people accused of involvement in a £12 million fraud committed against a number of NHS Trusts and other public and private bodies are to appear at Lincoln Crown Court in January.

The alleged scam involved people contacting organisations masquerading as legitimate construction companies contracted by them. The fraudsters allegedly claimed that their bank details had changed, and provided account numbers which instead belonged to companies owned or controlled by the defendants. The scam, known as ‘divert fraud’, involved payments for construction works were being diverted to other accounts.

This is the record - so far

http://www.bbc.co.uk/news/technology-34570713

19 October 2015

'Whale' finance fraud hits businesses

Cyber-thieves are stealing millions of pounds, with a scam based around faking email messages from company bosses.

The spoofed messages ask finance staff to rush through a payment to a supplier that the chief executive cannot handle because they are out of the office.

Experts have dubbed this "whaling" fraud because it targets "one big fish" as opposed to phishing, which tends to be aimed at lots of smaller fry.
US tech company Ubiquiti Networks said it had lost $47m (£30m) to this scam.

"The bad guys might only be after $100,000, but for a smaller company that's a lot of money."

http://www.thecomet.net/news/hitchin_school_falls_victim_to_240_000_fraud_1_4334755

Though I have no knowledge of the account to which these funds were transferred, it is a legal obligation on banks to scrutinise incoming payments and, if this receiving account was new or not regularly receiving such large sums of money, you'd have to ask why the incoming payment wasn't immediately referred as being suspicious. Bank staff are personally responsible for referring suspicious payments, risking prosecution if they don't, but this appears to be a law in the UK that exists merely as 'window dressing'.

This situation must change for the protection of not just the public but also corporations and banks themselves.

03 December 2015

Hitchin school falls victim to £240,000 fraud

Independent prep school Kingshott fell prey to fraudsters pretending to represent Hitchin building company Ashe Construction, which has been working at the Stevenage Road school in recent months.

The school cut the ribbon on its new Robinson building last month – the project has provided new classrooms, purpose-built music, art, food technology and science rooms, as well as changing rooms and a performing arts studio.

But the tricksters mocked up a fake letterhead and got in touch with the school to ‘inform them of a change in banking details’.

The school processed the false information and sent a payment of £240,000.

“Our bank has told us that unfortunately these type of crimes are becoming more and prevalent at SMEs and schools – we sent a letter to all our clients before this crime took place asking them to be aware of such types of fraud.