A haulage firm lost several large tax payments after their accountant’s email was spoofed.
What happened?
A haulage firm’s finance director had recently been in discussion with the firm’s accountants about a tax liability bill from the previous quarter that needed to be paid to the government agency responsible for tax collection. The tax owed amounted to £178,299. Due to transfers out of the firm’s corporate account being capped at £50,000 per day, the haulage firm was looking to pay this in four instalments; three payments totalling £50,000 and one totalling £28,299.
The finance director arranged for the first instalment to be transferred over to the tax collection agency. Shortly after this, the finance director received an email from his accountant, stating that he had been informed by the tax collection agency of a change of account details. The finance director responded by email and stated that he had made arrangements for the first payment to go to the old account details and asked whether this payment would need to be stopped. The accountant responded promptly and stated that the first instalment and all future ones should be paid into the new account. The finance director contacted the bank to see if they could halt the first instalment.
The next day, the bank contacted the finance director and told them it was too late to stop the first payment. The finance director emailed the accountant to let him know that the first payment had already gone through to the old account, going on to explain that he would look to send the other payments to the new account. With the accountant confirming that this would be fine, the finance director arranged for the next three instalments to be transferred to the new account. With the payments made, the finance director assumed that the matter was settled.
Unfortunately, there was a serious problem. The email that had supposedly been sent from the accountants about the change of account details was in-fact sent by a fraudster, using a method known as email spoofing.
What is email spoofing?
Email spoofing is when someone sends an email from one email address but labels it as being sent from a different one. Fraudsters use programmes or websites to help them make an email look as though it has come from a legitimate email address, as well as allowing them to alter the address that the recipient responds to.
In this case, the fraudster sent an email that appeared to come from the genuine email address of the finance director’s contact at the accountancy, whilst any response to these emails was sent to a very similar-looking email address belonging to the fraudster. This prevents the accountant from seeing the finance director’s responses to the emails, which would alert them to the scam. To add an air of authenticity, the fraudster also included the accountant’s genuine email signature, which included the accountant’s name, job title, contact details and a banner at the bottom advertising the accountancy’s services.
Given that the fraudster knew that the haulage firm had to make a payment to the tax collection agency and that the hacker had spoofed the accountant’s email address rather than sending it directly from his account, it is likely that the haulage firm’s finance director had had his account compromised through some sort of credential phishing scam, although when exactly this occurred was never fully established.
Not long after the payments had been made, the haulage firm received some correspondence from the tax collection agency, stating that although they had received a payment of £50,000, the firm still had £128,299 of tax left outstanding. The haulage firm’s finance director called the accountancy and it was only then that the scam was uncovered. The banks involved in the transactions were immediately informed of the fraudulent transactions, but despite their best efforts to reverse the payments, the account had been emptied and the funds were deemed unrecoverable.
How cyber insurance helped
Despite the circumstances, the tax collection agency was unwilling to compromise and still expected the amount outstanding to be paid by the haulage firm. Not wanting to get on the wrong side of the taxman, the business paid the amount owed but doing so left them out of pocket to the tune of £128,299. Thankfully, the haulage firm was able to recoup the funds under the cyber crime section of its cyber insurance policy with CFC, which provides cover for social engineering losses such as this.
Case Study takeaways
Senior team members are often prime targets for cyber criminals; these individuals usually act as the face of the company and as such, have bigger profiles on company websites and social media accounts, allowing cyber criminals to gather valuable information about them. Almost all modern businesses have some form of cyber exposure even if it’s just through the use of electronic payments or emails.
We hope we were able to provide insights into how skilful cyber criminals are becoming at parting businesses from their money, how difficult it is for people to spot a fake, and how a robust insurance policy can help. With access to several cyber liability products which can be tailored to your needs, McClarrons can help find the right cyber policy and cover for your business, giving you peace of mind around your protection.
For more information, or if you would like a complimentary insurance review, please do not hesitate to contact our Commercial Team on tel: 01653 609151 or by emailing commercial@mcclarroninsurance.com.
