Attempted Fraud Alert: Protecting Your Organization from Fraudulent Direct Deposit Requests

Attempted Fraud Alert: Protecting Your Organization from Fraudulent Direct Deposit Requests

As fraud attempts grow more sophisticated, businesses must stay vigilant to protect sensitive information and prevent financial losses. Recently, our organization experienced an attempted fraud involving a direct deposit request, where a fraudulent email targeted our payroll system by impersonating a senior executive.

In this case, an email was sent to our owner, pretending to be from another executive, requesting a change to their direct deposit account. The fraudulent request sought to switch the deposit from the executive’s current bank to an account at Green Dot Bank. If not detected, the attack could have resulted in salary payments being redirected and sensitive data compromised.

Several red flags were identified, which helped our team detect the fraudulent nature of the request:

  1. Forged Signature: The email included a forged signature that attempted to imitate the executive.
  2. Voided Check: To make the request seem legitimate, the fraudsters attached a voided check from Green Dot Bank, mimicking the standard procedure for direct deposit updates.
  3. Claims of Sensitive Information: The attackers claimed to have access to additional sensitive information, further enhancing the appearance of legitimacy.
  4. Matching Tone and Mannerism: The tone and style of the email closely matched the executive’s typical communication, making the message more convincing.

Below is the check presented with the Direct Deposit form requesting that the funds be deposited into account 799201957315 from Green Dot Bank account 124303120.  The email received was masked with the executive’s name, but when reviewing more carefully, the true email source was UFY7203@gmail.com.

How to Protect Yourself and Your Organization

To safeguard both personal and organizational information, consider the following precautions:

  1. Verify the Sender’s Identity: Always verify the identity of the person making financial or sensitive requests. Reach out directly via a trusted channel—such as a phone call or face-to-face confirmation—to ensure the request is legitimate. Never rely solely on email for verifying sensitive information.
  2. Avoid Clicking on Suspicious Links: Be cautious about clicking on links in emails, especially if the email seems even slightly suspicious. Hover over links to see the actual URL and check for inconsistencies.
  3. Do Not Open Attachments from Untrusted Sources: Never open attachments unless you are certain the sender is legitimate and trustworthy. Fraudsters often use attachments as a method to deploy malware or gather sensitive data.
  4. Inspect Documentation Carefully: Just because documentation, like a voided check, appears to be authentic, doesn’t mean it should be trusted without verification. Cross-check any documents with known, reliable sources.
  5. Training and Awareness: Ensure that all team members are trained to recognize phishing attempts and fraud tactics. The more personalized and convincing these attacks become, the more critical it is to educate staff on identifying subtle signs of fraud.
  6. Multi-Layered Security: Use multi-factor authentication and secondary verification processes for sensitive changes, such as payroll updates or vendor payments, to add an extra layer of protection.

Conclusion

The recent fraud attempt targeting our organization is a strong reminder that cybercriminals are constantly refining their tactics to exploit even trusted communication channels. Protecting both your personal information and our organization requires vigilance, careful verification, and attention to detail. By following these best practices and reporting suspicious activities, we can reduce the risk of fraudulent activities and protect our operations.

If you receive any suspicious emails or requests, please notify our security team immediately.

Below is a list of resources, categorized by country, that you can use to help protect yourself and report fraud:

United States:

  1. Federal Trade Commission (FTC)
    • Website: https://reportfraud.ftc.gov
    • Purpose: Report various types of fraud, including identity theft, online scams, and financial fraud.
  2. FBI Internet Crime Complaint Center (IC3)
    • Website: https://www.ic3.gov
    • Purpose: Report cybercrime, including internet fraud, hacking, and phishing.
  3. U.S. Securities and Exchange Commission (SEC)
  4. Better Business Bureau (BBB)
  5. U.S. Postal Inspection Service (USPIS)
  6. USA Government

Canada:

  1. Canadian Anti-Fraud Centre (CAFC)
  2. Competition Bureau Canada

United Kingdom:

  1. Action Fraud (National Fraud and Cyber Crime Reporting Centre)
  2. Financial Conduct Authority (FCA)
    • Website: https://www.fca.org.uk/consumers/report-scam-unauthorised-firm
    • Purpose: Report investment fraud, financial scams, and unauthorized financial services.

Australia:

  1. Scamwatch (Australian Competition and Consumer Commission)
  2. Australian Cyber Security Centre (ACSC)

European Union:

  1. European Consumer Centre (ECC)
    • Website: https://www.eccnet.eu
    • Purpose: Report cross-border consumer fraud, e-commerce fraud, and misleading business practices in the EU.
  2. Europol (European Union Agency for Law Enforcement Cooperation)

India:

  1. Cyber Crime Reporting Portal (Government of India)
  2. Reserve Bank of India (RBI)

New Zealand:

  1. Netsafe
  2. Financial Markets Authority (FMA)

South Africa:

  1. South African Fraud Prevention Service (SAFPS)
  2. South African Police Service (SAPS)

Global Resources:

  1. International Consumer Protection and Enforcement Network (ICPEN)
  2. USA Federal Trade Commission

These websites are valuable resources for reporting various types of fraud, ensuring that we can all act when encountering fraudulent activities.

Related Posts
About Us
businessman touching tablet
Our success is derived from the success of our clients. We pride ourselves in having assisted challenged financial service providers.

Let’s Socialize

Popular Post