Fraudsters have stolen almost €4.5m from Irish businesses through invoice scams in 2019, gardaí warn
ALMOST €4.5 million has been stolen by criminals from Irish businesses through invoice redirect fraud so far this year.
Gardaí are warning businesses to remind employees to treat any request to change bank account details "with extreme caution".
To date in 2019, over €4.4 million worth of invoice redirect fraud, also known as CEO fraud, has been reported to gardaí.
Over €2.27 million was stolen in April alone - and in excess of €1.28 million as been recovered by gardai, financial institutions, financial intelligence units worldwide and foreign police forces.
CEO fraud sees criminals sending emails to businesses purporting to be one of their legitimate suppliers. The emails may contain a request to change the bank account details that the business has for a legitimate supplier, to bank account details that ultimately benefit the criminals.
According to gardaí, the criminal intention is when the 'supplier' next sends an invoice to the company seeking payment for services rendered or goods supplied.
The victim business then acts on the new banking instructions and sends the payment to the criminal’s bank account, where the funds are quickly transferred or withdrawn.
In many cases, the business doesn't know it is a victim of invoice redirect fraud until sometime later, when the legitimate supplier sends a reminder invoice for payment.
In one case, a business received an email from a customer requesting that money be transferred to a new account.
"The email looked like it came from the customer and the money was owed so it was transferred," a Garda spokesperson said.
"This lead to 1m US Dollars being transferred to a bank account in Hong Kong. Luckily in this case, this was reported swiftly and in conjunction with the FIU in Hong Kong, An Garda Siochana was able to block the movement of this money in an account there and it has been recovered."
In another recent case, a company reported an email redirect fraud to the value of €463,244.48.
"An email was received posing to be supplier requesting that account details be changed for payment," gardaí said.
"Payment of above amount then made. Discovered that email was bogus. Again, due to prompt reporting, An Garda Siochana in conjunction with the financial institution was able to recover 95pc of this money."
Gardaí are encouraging businesses to make independent contact with suppliers to verify the contents of invoices and emails.
"Under no circumstances should contact details contained in the email or attachments be relied upon to verify the request whether these consist of a physical address, an email address or a phone number," they said.
"In that context, all existing business relationships should be reviewed without delay and defensive policies and procedures put in place."
Detective Chief Superintendent Pat Lordan, of the Garda National Economic Crime Bureau, added: "Stop and think before you change bank account details for anyone.
"Ask the question, is this really the person or company you owe money to. Pick up the phone and speak to the person concerned."