Payment Diversion Fraud
Payment Diversion Fraud involves fraudsters creating false invoices or false request for payment, or the diversion of payments in order to defraud you or your organisation.
Social engineering is a significant part of the Payment Diversion Fraud process where
cyber criminals pose as trusted and recognised entities and use a sense of authority
and urgency to manipulate individuals and employees into making a bank transfer or
providing confidential information.
One of the main types of Payment Diversion Fraud in the NHS usually targets staff
within an organisation’s finance and procurement departments. An email which appears
to come from a known supplier is sent by the cyber-criminal to a member of staff. The
email will request that future payments for products or services are made to a new bank
account and will give a reason for the account change. The new account will be under
the control of the cybercriminal and any funds paid into it will be lost.
In the year to September 2020 there were 61 attempts of Payment Diversion Fraud
against the NHS of which 9 were successful resulting in losses of £1.5 million.
In July 2020, an NHS Trust was defrauded of £375,000 by fraudsters impersonating a
construction company that had recently undertaken work for them. The Trust received a
spoofed email (two letters had been switched in the domain part of the email) purporting
to be the office manager of the construction company and stating that the company’s
account details had changed. This led to three payments being made into two different
bank accounts.
A recently identified Salary Diversion Fraud attack on the NHS involved cyber criminals
sending a
phishing
email to target a staff member directly as opposed to the organisation’s payroll
department. The attack can be broken down into the three stages of the cyber fraud
lifecycle.
Cyber-attack phase
A malicious phishing email was received by an NHS employee indicating that
something in their Electronic Staff Record (ESR) account required their attention,
in other cases emails have included a false incentive such as a notification of a
pay rise. The sender’s email address appeared to be genuine, however they were
mimicking a genuine colleagues email address who they knew. The email contained a
link to a website which appeared to be the genuine NHS ESR log on page. However,
the link directed the staff member to a malicious website where, what appeared to
be a genuine ESR logon page had been created. When the staff member entered their
log on details, believing they are using the genuine ESR website, the
malicious website
allowed the fraudster to obtain the staff member’s username and password.
Data exploitation phase
Once access to the staff member’s ESR account was obtained, the cybercriminal was
able to access personal information relating to the staff member, such as their
national insurance number, date of birth, home address, email address, phone
numbers and emergency contact details.
Cash out phase
Having accessed the staff members ESR account, the cybercriminal was able to
change the bank account details, diverting the employee’s salary into an account
controlled by the criminal before the crime could be detected and stopped.
Responding to Payment Diversion Fraud
-
If you believe you might have revealed sensitive information about your organisation,
report it to the appropriate people within the organisation, including network
administrators. They can be alert for any suspicious or unusual activity.
-
If you believe your financial accounts may be compromised, contact your financial
institution immediately and close any accounts that may have been compromised.
Watch for any unexplainable charges to your account.
-
Immediately change any passwords you might have revealed. If you used the same
password for multiple resources, make sure to change it for each account, and do
not use that password in the future.
-
Be suspicious of unsolicited email messages which should always be checked
to verify accuracy.
-
Don’t click on the links or attachments in suspicious emails, and never
respond to unsolicited emails that ask for your personal or financial details.
-
Be vigilant of email addresses that appear to be from NHS organisation however
are slightly altered.
-
Do not provide personal information or information about your organisation,
including its structure or networks, unless you are certain of a person's
authority to have the information.
-
Do not reveal personal or financial information in email, and do not respond
to email solicitations for this information. This includes following links
sent in email.
-
If you are unsure whether an email request is legitimate, try to verify it by
contacting the company directly. Do not use contact information provided on a
website connected to the request; instead, check previous statements for
contact information.
-
Always verify details of any new / amended payment instructions verbally by
using details held on file, and not on the instruction. Fraudsters can spoof
email addresses to make them appear to be from a genuine contact, including
someone from your own organisation.
-
If you are suspicious about a request made by phone, ask the caller if you can
call them back on a trusted number. Fraudsters will attempt to pressure you into
making mistakes — take the pressure off by taking control of the situation.
-
Look carefully at every invoice and compare it to previous invoices received
that you know to be genuine, particularly the bank account details, wording
used and the company logo.
- Watch for other signs of identity theft.