Since January 2017, the Police have received more than 110 reports on business email impersonation scams, an increase of about 20% from the same period last year. The total amount lost through this type of scam in 2017 to date has exceeded $13 million, as compared to about $15 million for the same period in 2016.
The victims were deceived into transferring money to foreign bank accounts for business payments. They believed that they were paying their regular business partners, only to discover later that the request for payments were not made by their business partners, and the accounts did not belong to them.
Such cases usually involve businesses with overseas dealings and use email as their main mode of communication. In many of the cases, the Police believe that the scammers may have hacked into either the email accounts of the victims or their suppliers, to familiarise themselves with their email correspondences. They would then use the supplier’s email account or create a spoofed email account, closely resembling that of the suppliers’, to send email instructions to the victims, asking them to transfer payments to a new bank account.
These are some examples of spoofed email addresses:
|
Genuine email |
Spoofed email |
In order to deceive the victims, the scammers may also closely mimic the emails of the real suppliers, for instance, by using the same business logos, links to the company’s website, or messaging format. The unsuspecting victims will thus believe that they had received a genuine email from their suppliers and transfer money to the new bank account. These victims will only know that they have fallen prey to the scam when their supplier informs them subsequently that they have not received the money.
On 22 January 2016, a local company received an email that was purportedly sent by their overseas business partner, with instructions to make payment of USD 56,790 to purchase equipment. Not realising that their business partner’s email had been compromised, they thought that the email was actually sent by them, and transferred the money to the foreign bank account provided in the email as instructed. Subsequently, they realised that their business partner’s email account was compromised when they discovered minor discrepancies in the email addresses used by the sender. They then called their business partner who confirmed that he did not send the email to them. Fortunately, the funds were successfully recalled as the remitted funds were still in the foreign bank account.
However, successful recoveries are far and few. Although the Police have been working closely with financial institutions and foreign counterparts to recover funds for victims of such scam, the scammers would usually transfer the funds out of the foreign bank accounts very quickly, thus making it difficult to recover these funds. If your business has been affected by this scam, please contact your bank immediately to recall the fund transfers.
Businesses are advised to adopt the following preventive measures:
- Prevent your email account from being hacked by using strong passwords, changing them regularly, and enabling two-factor authentication. Install anti-virus, anti-spyware/malware, and firewall on your computer, and keep them updated. Also use the latest computer Operating System (OS) and keep them updated when new patches are available.
-
Be mindful of any sudden changes in the payment instructions and bank accounts provided by your business partners or creditors. Call back to verify changes in payment instructions and bank accounts. Previously known phone numbers should be used instead of the numbers provided in the fraudulent email.
- Educate your employees on this scam, especially those that are responsible for making fund transfers
If you wish to provide any information related to such crimes, please call the Police hotline at 1800-255-0000, or submit it online at www.police.gov.sg/iwitness. If you require urgent Police assistance, please dial ‘999’.
To seek scam-related advice, you may call the anti-scam helpline at 1800-722-6688 or go to www.scamalert.sg. Help spread the word and share this advisory with your employees and business partners to prevent them from being the next victim of scam.
SINGAPORE POLICE FORCE
22 June 2017 @ 3:35 PM