Businesses warned about 'catastrophic' impact of invoice fraud

Invoice fraud cost Irish businesses around €10.5m in 2020, gardaí have said. Picture: PA

Gardaí and banks are warning businesses of the potentially “catastrophic” impact of scams where fraudsters pose as legitimate suppliers seeking monies owed.

Invoice fraud cost Irish businesses around €10.5m in 2020, gardaí have said.

The banks’ payment body said that while businesses are aware of the threat, there appears to be “complacency” among some firms in taking action to prevent it.

A Garda statement said that “invoice redirect fraud” or “business email compromise fraud” is where the fraudsters send an email to a business purporting to be from a supplier, requesting the immediate payment of an invoice or transfer of funds.

“Fraudsters may spoof an email address, send ‘spear phishing’ emails or use malware to get the data,” said the statement.

Fraud Awareness Week

Marking day three of Fraud Awareness Week, the Garda statement said criminals could also take over the email account of a real business, meaning the email seeking to defraud the company targeted is coming from a real business.

The statement said that data can be stolen in “large data breaches”.

Gardaí say that victims of this fraud range from very small businesses to large corporations.

“The consequences of falling for a scam of this nature can be catastrophic for any business and can result in the closure of businesses and redundancies,” said the statement.

It recommended that all relevant employees should receive training in relation to avoiding this type of scam.

Gardaí said that, in most cases, the money taken is transferred abroad, making retrieval difficult.

It added that proceeds of these crimes can also be laundered through accounts in Ireland.

The Garda National Economic Crime Bureau advises:

• Ensure staff take great care and attention each time they are asked to change bank account details. Check the Iban number — what country is it in? Ibans can be checked by doing a very quick google search. Check the URL and the spelling;
• A phone call should be made to a confirmed representative of the company confirming that the bank account is changed. Under no circumstances should contact details contained in the email or attachments be relied upon to verify the request, whether these consist of a physical address, an email address, or a phone number.

Banking and Payments Federation Ireland (BPFI) said that while the threat from invoice fraud is not new, it is “one of the biggest fraud threats” facing businesses over the last 12 months.

BPFI head of fraud prevention Niamh Davenport said the fraud can be “particularly devastating” for SMEs, as reflected in the figures reported by the gardaí.

“Invoice fraud is mainly carried out via email and takes place when a business receives an email pretending to represent one of their existing suppliers or creditors and told that bank account details for the payment of future invoices should be changed or made to a different account,” said Ms Davenport.

The request may look authentic, it may appear to be authentic, but on close examination it is a scam. 

"If the request is acted upon, the next legitimate payment will be made directly to the fraudster’s account."

“While businesses are aware of the threat that financial fraud poses, there appears to be complacency among some businesses around putting proper guidelines and procedures in place to combat it. 

"Protecting your business from invoice fraud doesn’t have to be a costly task; in fact, a few low-cost measures can help prevent it from happening.”