The FFA UK has warned that this activity has intensified in recent weeks and is urging businesses to remain vigilant.
Fraudsters email the invoices on text or spreadsheet documents to firms, whilst claiming to be a regular supplier or trusted organisation. However, opening triggers instructions which capture the company’s financial data.
The fraud operates because on opening the attachment, victims unwittingly enable a macro on their computer system. This macro in fact installs malware (malicious software) onto their computer.
The malware, which in some cases can also infect the business’ entire computer network, will then log the company’s online banking credentials and other financial information, before sending it back to the criminal. The data is then used to steal money from the business’ bank account.
A sinister change in approach
It is thought that fraudsters are changing their tactics as businesses are become increasingly aware of the threats posed by phishing emails.
In this new method, criminals often try to mimic the email address of a legitimate supplier, or go as far as to compromise their email address, in a bid to trick the recipient into thinking the invoice is genuine.
In some cases, fraudsters have even replicated the email address of someone working in the same company as their victim, tricking them into thinking the invoice has come from a colleague or manager.
Top tips to avoid becoming a victim of the scam:
- Be on the lookout for unexpected invoices or unusual payment requests, especially those arriving in different file formats to normal.
- Avoid enabling any macros on an untrusted document. (Macros in themselves are not dangerous and do serve a legitimate purpose – but they can be used to hide malware).
- If you’re suspicious – don’t reply to the email but instead call your supplier on the number that you have on file to check the authenticity of the invoice.
- Ensure you have the latest anti-virus and security updates installed on your computer and consider using high-level macro security settings in software applications.
- Ensure strong firewalls are in place to help detect malware and prevent data leaving the network without permission. This can be achieved through investing in IT and seeking professional advice.
Award-winning chartered accountants offering tax, audit and advisory services.