As most of us already know, the banking sector has already begun to implement the Payment Systems Regulator’s new rules to protect victims of Authorised Push Payment fraud (which is when someone is tricked into sending money to a fraudster via bank transfer). The new rules mean that victims will be reimbursed up to £85,000 within five business days of making a claim we and expect that over 99% of claims by volume will be covered.

But….. Organised Criminal Gangs are ALREADY exploiting this scheme by identifying vulnerable Company Directors (one very recent example I heard about involved a Director with a penchant for buying a couple of grams of coke every Friday night whilst another involved an Accountant who was having an extra-marital affair with the relative of a gang member) and then compelling / blackmailing them to engage in a “mock” APP fraud.

What happens next is frightening and almost impossible to detect.

The gang, together with the complicit Director, will “stage” an APP fraud:

1. the Director will receive a telephone call via his company switchboard from a spoofed bank phone number;

2. a substantial sum of money will be transferred by the Director to an account which bears all the hallmarks of a typical mule account;

3. the money will be drained from the mule account in the usual way, and;

4. the Director then makes a distressed phone call to the Police and bank, complaining about having fallen victim to a fraud.

At all stages of this fraud, the gang controls the Director and ensures that everything is done / reported properly so as to guarantee a reimbursement.

Once the company is refunded, the gang keeps the proceeds of the fraud and the Director carries on as normal (and is no worse off, at least financially).

In the coming weeks and months this specific threat vector will balloon.

The financial sector must quickly learn how to detect it WITHOUT running the terrible risk of “victim blaming” at a time when a genuine victim will already be in a desperate state.

This is one reason why a deep understanding of the fraud mindset is invaluable.

The gang, together with the complicit Director, will “stage” an APP fraud:

1. the Director will receive a telephone call via his company switchboard from a spoofed bank phone number;

2. a substantial sum of money will be transferred by the Director to an account which bears all the hallmarks of a typical mule account;

3. the money will be drained from the mule account in the usual way, and;

4. the Director then makes a distressed phone call to the Police and bank, complaining about having fallen victim to a fraud.

At all stages of this fraud, the gang controls the Director and ensures that everything is done / reported properly so as to guarantee a reimbursement.

Once the company is refunded, the gang keeps the proceeds of the fraud and the Director carries on as normal (and is no worse off, at least financially).

In the coming weeks and months this specific threat vector will balloon.

The financial sector must quickly learn how to detect it WITHOUT running the terrible risk of “victim blaming” at a time when a genuine victim will already be in a desperate state.

This is one reason why a deep understanding of the fraud mindset is invaluable.

-----
Alex Wood is a reformed fraudster who advises copanies on fraud detection, prevention and mitigation.