Criminals are using a new method to hi-jack corporate identities, to compromise their bank accounts with a view to effecting high value transfers to foreign recipient banks, City of London police warn.
These attacks have been aimed at foreign-based companies, who usually have a representative office in the UK, and who have existing accounts with a UK Bank. The intended victim will also usually have a ‘faxed indemnity’ arrangement in place with the bank. Popular targets have been foreign airlines, banking institutions and even embassies.
The criminals contact the ‘Relationship Manager’, at the relevant UK bank, purporting to be the genuine client and inform them that they are changing their contact details, usually giving the excuse that a temporary move of office is necessary due to refurbishment. A new telephone and fax number, and occasionally an e-mail address, will then be supplied to the Relationship Manager. The telephone numbers given are generally arranged in advance, via the Internet, and are able to be diverted to mobiles and ‘fax to e-mail’ facilities. Confirmation will usually be requested by the criminals from the bank, acknowledging the new details, and this will provide the criminals with a headed, signed fax from the bank, which can be copied and manipulated for future use against the intended victim.
At the same time, the criminals will also make contact with the Finance Director, or equivalent, of the targeted company purporting to be the Relationship Manager of the relevant UK bank. The same, new telephone and fax contact numbers will also be provided to the company using the excuse that the bank is experiencing computer problems or their records need updating. Again, confirmation will be requested from the company acknowledging the new contact details, and a headed, signed fax will be forwarded to the criminals which can subsequently used by the criminals in their correspondence with the bank.
Once these steps have been taken, the criminals are then effectively in control of the direct line of communication between the bank and client. The criminals will then either; request that a new account be opened with the UK bank and the company’s existing overdraft facility be extended to this account or continue to forward any faxed indemnity transfer requests they receive from the victim to the Bank as normal. After a short period of time, the criminals will then fax the bank a number of high value transfer requests, from the existing or newly opened account, to recipient accounts usually based in Japan or Pakistan, resulting in substantial losses to the victims.
It is apparent that the criminals carry out ‘homework’ before making the approach to the bank and the intended victim, as they usually know the management structure of the target company and will use the name of the relevant Finance Director or similar in their correspondence. They will also usually know the name of the relevant Relationship Manger at the bank, to whom they need to speak.
