A Perth motor vehicle dealership has lost $65,000 after being stung by a ‘man in the middle’ scam involving the payment of an invoice to a bank account that had been changed.

The dealership recently made a purchase from a supplier and received an invoice with correct bank details. A week later an email request, sent by scammers, was received asking to direct the funds to a new bank account. The dealership asked that the request be made on company letterhead which was supplied.

An attempt was made to get a verbal confirmation of the change, in accordance with the dealer’s procedures, but the contact number provided was not answering. The payment was made regardless. The scam wasn’t detected until the real supplier later queried the non-payment of the invoice.

Commissioner for Consumer Protection David Hillyard said scammers will particularly target businesses that transfer funds involving large amounts.

“All businesses need to be alert to attempts by scammers to intercept payments that flow to and from their accounts and ensure their email accounts and computer systems have security software to reduce the likelihood of becoming a victim of hacking,” Mr Hillyard said.

“Closely scrutinise all invoices and query any changes to ensure that the payments are going to the correct accounts. Get a verbal confirmation of email requests to change the bank account details of suppliers and clients and ensure all staff members are aware of the anti-fraud procedures and the importance of adhering to them without exception.

“Sometimes the accounts staff will get a fake email purporting to be from the business manager requesting an urgent payment be made to a particular bank account belonging to the scammers. If a request seems unusual or strange, query it and confirm it before paying.”

“The real estate industry has been targeted in the past with huge losses suffered, so now motor vehicle dealers need to be vigilant as scammers will use this recent success to make further attempts to steal money from other business operators.”

There are some simple steps business operators can take to help manage the risk:

• Use a business grade, hosted email service that includes quality filtering to block dangerous emails, spam, phishing and malicious content or attachments.
• When responding to emails, use the forward button instead of reply, and manually type or select the address from your address book. This will help make sure you're communicating with the right person.
• If an attachment comes in an unusual format like .zip or the email asks you follow a link to a file hosting site, this should be a red flag. If the apparent sender is known to you, call them and double check.
• Delete generic spam immediately.
• Regularly check sent and deleted items folders as well as bank accounts for any unusual activity. This can help you to detect if an account has been compromised.
• Staff should have regular training on cyber security and fraud prevention, and consider having your system security reviewed by a reputable IT security firm.
• Verbally confirm any changes to bank account details with clients. Make sure each staff member uses their own individual login – do not share passwords.
• If you receive an email that seems unusual, you can report it via WA ScamNet's online scam report.

For further information or to report a scam, visit www.scamnet.wa.gov.au or email wascamnet@dmirs.wa.gov.au or call 1300 30 40 54.

<ENDS>

Media Contacts:

Alan Hynd – Consumer Protection, (08) 6552 9248 / 0429 078 791 / alan.hynd@dmirs.wa.gov.au