More needs to be done to combat international computer fraud

18 Jan 2024

More needs to be done to combat international online fraud to protect small businesses and improve detection.

That is the view of West Suffolk Council, Cabinet Member for Resources, Cllr Diane Hind after hackers gained control of a business’s email account to scam the council.

A report into the £52,000 theft, will be heard by the council’s Performance and Audit Scrutiny Committee on 25 January explaining what happened and measures that have been taken.

The council was subject to a bank mandate fraud in July 2023 resulting in payment being made to a fraudster instead of the intended supplier. This was due to hackers using the official email of a business to then scam a third party as all correspondence is from the official account of the business.

This type of fraud is targeted at both the public and private sector as well as individuals. The National Crime Agency has stated that in the year to September 2021 (these are the most current figures reported) there were reported losses of around £152m and over 4,600 individual cases.

The report outlines how:

Unfortunately, although the email was from the correct and verified address, our supplier had been the subject of a sophisticated cyber-attack and at this stage an additional internal process to verify bank account changes was not correctly followed and as a result, this fraudulent invoice was paid.

The council’s banking partner notified the authority of a potential fraud but could not prevent the payment being made to the fraudulently provided bank account.

Following this initial response communication continued with the supplier, the banks, law enforcement, legal advisors, e-mail providers and other connected agencies in order to clarify what had occurred and to seek recovery of the amount paid.

The incident was reported to the Police and Action Fraud which is the UK’s national reporting centre for fraud and cybercrime where any such fraud should be reported. Action Fraud is run by the City of London Police on behalf of all UK police forces and make a decision whether it should be passed onto the Police for investigation.

Internal audit carried out an investigation which covered the circumstances, what had gone wrong and what needed to be put in place to reduce the change of it happening again. The council’s external auditors were also notified.

Internal audit also confirmed that staff were not involved in perpetrating the fraud.

The service and staff involved were spoken to and training given and procedures strengthened as well as further guidance given to staff.

Cllr Diane Hind, Cabinet Member for Resources for West Suffolk Council, said: “This incident was extremely regrettable and from the statistics many organisations are unfortunately affected by such scams. West Suffolk, like many organisations is daily targeted by scammers but this is the first time the council has been defrauded in this way. This type of crime is very hard to successfully investigate and prosecute, Unfortunately, it has devastating effects for small businesses who are not geared up to detect this type of crime or have the resources to survive it if they fall victim.

“Following investigations by our auditors we have taken measures to reduce the risk of it happening again and have strengthened training and procedures. Upon discovery of the fraud, the immediate steps taken were to contact the receiving bank to seek recovery, and the issuing bank to review potential avenues of escalation. All other potential payments to the supplier were put on hold. The police (through their Action Fraud reporting centre) were also contacted, and the scam reported once it was established a fraud had been committed.

“We have put as much as we can into the public domain without hindering any criminal investigation or providing useful information to other scammers. We want to do this, not only to provide transparency for residents but also so other businesses can learn and take measures themselves. What is clear is there needs to be more of a national focus on this to improve detection and to stop businesses falling victim. The recent bank mandate fraud is a reminder to us all that we must remain vigilant from the threat of such sophisticated fraudsters. Bearing in mind the level of fraud and amounts of money being scammed the Government and businesses, such as email providers, need to do more to focus on this issue.”

---