Authorised push payment (APP) scams happen when criminals persuade you to make a bank transfer. They'll usually pretend to be from a reputable business or organisation and try to pressure you into acting quickly. This is so you don't have time to realise it's a scam.
Here are some of the most prevalent APP scams impacting business customers.
Business E-mail Compromise (BEC) is a sophisticated scam targeting businesses that make regular payments, tricking them into making payments to a fraudsters account, instead of the genuine payees account.
Main variations of this type of scam involve:
Email spoofing – The fraudster spoofs an email address, usually a supplier’s or a business owners’. It doesn’t require compromising any email accounts but instead, the invoice is sent from an email account that is so close to the domain of the vendor that most people would miss the change, for example, @CompanyABC.com instead of @CompanyACB.com.
A Compromised Email Account - This involves the actual compromise of a supplier’s email account or one of the business’ senior staff’s email account (such as the CEO).
Using one of the methods above, the fraudster sends an email to the individual or team responsible for making payments. The email is usually well timed, is written in the correct tone and contains a sense of urgency. Sometimes the request will be to pay a new beneficiary but often, the request is to pay a known supplier, using new account details which the fraudster has provided.
In this scam, criminals call pretending to be from the police or your bank, convincing you to make a payment to an account they control. They might also claim to represent a utility company, IT support or government department.
The most common scam is where the fraudster informs you there has been fraud on your bank account, and you must move money to a ‘safe account’. Common scams include bogus claims that the victim must settle a fine, pay overdue tax or return a refund. Sometimes the criminal asks for remote access to the victim’s computer as part of the scam, claiming they need to help ‘fix’ a problem.
Purchase scams happen when you pay for an item or services that never materialise. The company seemingly disappears and your money is lost.
Typically, these scams:
Criminals may contact you to offer investment opportunities which may seem too good to turn down. They often use false testimonials, fake celebrity endorsements, spoof websites and fake companies with names similar to genuine organisations. In lots of cases, they will also provide lots of convincing marketing materials to make the scam appear genuine.
Recent scams involve investment opportunities in gold, property, wine and cryptocurrencies.
Infographic – Tips on staying safe from Business Email Compromise scams
Take 5 – Stop, Challenge and Protect
NCSC – National Cyber Security Centre advice and guidance on a range of cyber topics
