Although the diversion of bank transfers as a form of fraud is not entirely a new invention in the field of cybercrime, it has gained a great deal of ground in the changed circumstances of recent times. According to the FBI, along with ransomware, payment diversion fraud is among the criminal acts causing the most significant financial damage.
What exactly does payment diversion mean?
In the course of payment diversion fraud, cybercriminals persuade a company’s employee dealing with financial affairs to transfer or pay a sum to them without, of course, the employee being aware he or she is not acting on the orders of senior manager or a supplier, but is becoming a victim of deception. By the time the fraud is discovered, the amount disappears in the depths of the Internet, thanks to the international money laundering systems, and its recovery is practically impossible, or at least extremely difficult.
The proliferation of payment diversion fraud is indicated by the the fact that new cases have recently come to the surface almost monthly. The magnitude of the damage caused is typically at least HUF 10 million, but occasionally as high as HUF 750 million per company. Since these funds are practically never recovered, the most effective way to avoid a crime of significant financial damage is prevention.
“We do everything according to rules, so this can’t happen with us…”
Payment diversion fraud has been present before COVID-19, but since the majority of companies moved from their regulated environment to employees’ homes, the risk has increased significantly. Personal contacts may have shifted entirely into the online environment, and the phone numbers used to contact people may have changed. However well-regulated the financial processes of a company may be, with regular checks in place, cybercriminals, or even insider offenders may exploit the uncertainty caused by the changed situation, and completely mislead the employees of the company. In case of most companies that have become the victim of fraud, there were adequate regulations and regular checks in place
How can we help?
Summarising our experience gained in the course of the investigation of payment diversion fraud, we have prepared a comprehensive prevention and control plan in which we pay particular attention to the vulnerability of financial processes – bank transfers and supplier relations.
In addition to identifying the risks associated with the methods of perpetration, this plan also includes a review of the processes from a forensic point of view, as well as an examination of the tools at the disposal of employees who may be targeted by cybercriminals to help recognize cases of fraud.
After a comprehensive due diligence of the processes concerned and the evaluation of the results of personal interviews, we make recommendations on how to eliminate the shortcomings of the processes and, if necessary, also provide training to the employees of the company to improve their ability to prevent fraud.
