Account-switching scam nets fraudsters £126m a year

Police say a fraud technique that involves intercepting legitimate payments and diverting them to a new account netted fraudsters some £126m last year, with 5,000 people falling victim.

The account-switching scam, also known as 'mandate' or 'invoice' fraud, was practised 71 per cent more often in 2015 than 2014. Last year, there were 5,480 cases, compared with 3,206 in 2014.

There are two main varieties of the fraud: in the first, a company's IT systems are infected with malware that allows criminals to spy on emails. They choose their moment to contact a customer who is about to make a payment.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

Pretending to be from the firm in question, the scammers write to that customer, asking him or her to make the payment to a different account. The email appears to the customer to have come from the correct address.

In the other version of the fraud, sometimes dubbed 'CEO fraud', a fraudster writes to a junior employee of a company, pretending to be a senior figure in the same organisation. They ask him to make a payment – and the victim is often too overawed to question the instruction.

Georgia Morandi from Cambridgeshire told the BBC she lost £2,514 to the first version of the scam after having a new wood-burning stove fitted. The fitter's email account was compromised and scammers wrote to her telling her to pay a different bank account.

Morandi made the payment and then discovered the actual fitter had not received a single penny. In the end, her bank compensated her – and she was able to pay the real stove-fitter – but it did this as goodwill gesture.

Chris Greaney of City of London Police told the BBC: "Sadly email is just not safe and you cannot trust it all the time. The best thing for any individual to do is to pick up the phone and speak to the business they are dealing with."