New Instances Of Fraud Affecting The Credit Insurance Market

We have seen a number of cases recently, affecting our credit insurance clients, where there have been fraudulent interceptions of email communications in trade transactions.

The most common scenario is that emails between the buyer and seller are intercepted by a third party. The third party informs the buyer, either through a fraudulent invoice sent by email, or through the text of an email, that payments should be made to its bank account, rather than any previous bank account details they have on record for the seller.

Several buyers have been defrauded by such scams, and have transferred payment to bank accounts which do not belong to the seller. The seller has then chased for payment, and the buyer indicates that payment has already been made. Both parties then discover that payment was made to the wrong bank account. The seller will remain unpaid and chase for payment, whilst the buyer will insist it has paid, and in some cases, accuse the seller of responsibility for perpetrating the fraud (eg. through a rogue employee).

How are such scams perpetrated?

There are various methods of perpetrating such scams. One method we have come across is "malware spying" software being introduced into the computer of one of the seller's employees. The software can be introduced through a malicious spam email which, once opened by the employee, results in a "hacker agent" being installed onto the computer. The "hacker agent" allows the computer to be remotely controlled by another user, and also allows the hacker to steal data from the infected system.

A common feature of this type of fraud, is that the third party fraudster makes use of fraudulent email addresses that resemble the seller's original email addresses. This allows the fraudster to intercept emails that were intended for the buyer, but also to masquerade as the seller's employees to correspond with the buyer, allowing the fraudster to provide false instructions to the buyer to divert payment from the intended beneficiary.

In a long chain of emails, the fraudulent email addresses can be very difficult to spot. For example, compare the following fictitious email addresses:

Bernard.Lee@leeandhiggins.com

Bernard.Lee@leeandhigglns.com

It would of course also be possible for a fraudster to perpetrate the fraud through intercepting the computer of one of the buyer's employees.

How do these scams affect credit insurers?

These scams affect credit insurers because buyers will usually refuse to...