Protecting yourself against financial fraud

If you receive a request to provide personal or financial information, you need to take a moment to reflect and step back from the situation. Yes, even if they say they’re the bank or other trusted organisation, you still need to take the time to stop and think about what’s really going on.

Deep down, you probably already know these basic rules on how to beat financial fraud – you just need to take a breath and stay calm enough to remember them.

1. Requests to move money.
   A genuine bank or organisation will never contact you out of the blue to ask for your PIN, full password or to move money to another account.
   
   Only give out your personal or financial details to use a service that you have given your consent to, that you trust and that you are expecting to be contacted by.
2. Clicking on links/files.
   Don’t be tricked into giving a fraudster access to your personal or financial details. Never automatically click on a link in an unexpected email or text.
3. Personal information.
   Always question uninvited approaches in case it’s a scam. Instead, contact the company directly using a known email or phone number.
4. Don’t assume an email or phone call is authentic.
   Just because someone knows your basic details (such as your name and address or even your mother’s maiden name), it doesn’t mean they are genuine. Be mindful of who you trust – criminals may try and trick you into their confidence by telling you that you’ve been a victim of fraud.
   
   Criminals often use this to draw you into the conversation, to scare you into acting and revealing security details. Remember, criminals can also make any telephone number appear on your phone handset so even if you recognise it or it seems authentic, do not use it as verification they are genuine.
5. Don’t be rushed or pressured into making a decision.
   Under no circumstances would a genuine bank or some other trusted organisation force you to make a financial transaction on the spot; they would never ask you to transfer money into another account for fraud reasons.
   
   Remember to stop and take time to carefully consider your actions. A genuine bank or some other trusted organisation won’t rush you or mind waiting if you want time to think.
6. Listen to your instincts.
   If something feels wrong then it is usually right to question it. Criminals may lull you into a false sense of security when you are out and about or rely on your defences being down when you’re in the comfort of your own home. They may appear trustworthy, but they may not be who they claim to be.
7. Stay in control.
   Have the confidence to refuse unusual requests for personal or financial information. It’s easy to feel embarrassed when faced with unexpected or complex conversations. But it’s okay to stop the discussion if you do not feel in control of it.
   
   If you’ve taken all these steps and still feel uncomfortable or unsure about what you’re being asked, never hesitate to contact your bank or financial service provider on a number you trust, such as the one listed on their website or on the back of your payment card

Fraud over the phone – or Vishing – is when a fraudster calls claiming they’re from your bank or some other trusted organisation. It is easy for them to convince you too, since they can both fake the telephone number on the screen and do their research to find out some of your basic bank and personal details.

Remember though, a genuine bank will never ask you for personal or financial details like your PIN number or full banking password (even by tapping it into your phone keypad).

5 things to look out for on a scam phone call:

1. The caller doesn’t give you time to think, tries to stop you speaking to a family member or friend or is insistent and makes you feel uncomfortable.
2. The caller asks you to transfer money to a new account for fraud reasons.
3. They phone to ask for your 4-digit card PIN or your online banking password. Even if they ask you to give it to them by tapping into the telephone keypad rather than saying the numbers out loud, this is a scam.
4. They ask you to withdraw money to hand over to them for safe-keeping.
5. They may say that you are a victim of fraud and offer to send a courier to your home to collect your cash, PIN, payment card or cheque.

A text might not be from who you think – Smishing is when criminals pretend a message is from your bank or another organisation you trust.

They will usually tell you there has been fraud on your account and will ask you to deal with it by calling a number or visiting a fake website to update your personal details. Please take a moment to stop and think and realise this is the fraud…

3 signs a text message might not be genuine:

1. It asks you to provide sensitive personal or financial information, passwords, or to make transactions by following a link in the message.
2. It asks you to call a certain number but that number is unknown to you. In this case, call your bank on a number that you trust to check the number and message is authentic. E.g. – such as the number on the back of your card.
3. The sender uses an urgent tone, urging you to ‘act now’.

Criminals don’t just try and contact you by phone and text, they also ‘phish’, contacting you by email too. So always be suspicious of unsolicited emails that are supposedly from your bank or some other trusted organisation because the address can easily be faked.

Never automatically click on any links they contain either, not before stopping to check if they seem genuine first.

7 ways to spot an email you’ve been sent is a scam:

1. The sender’s address doesn’t match the website address of the organisation it says it’s from. Roll your mouse pointer over the sender’s name to reveal its true address.
2. The email doesn’t use your proper name – using something like “Dear customer” instead.
3. There’s a sense of urgency, asking you to act immediately.
4. There’s a prominent website link which may seem like the proper address, but with one character different.
5. There’s a request for personal information.
6. There are spelling and grammatical errors.
7. The entire text of the email is within an image rather than the usual text format and the image contains an embedded hyperlink to a bogus site. Again roll your mouse pointer over the link to reveal its true destination.

Online fraud covers everything from online shopping to online banking, but one thing can help prevent both: take the time to install the built-in security measures most browsers and many banks offer.

These can help protect you whether the criminals are trying to dupe you with fake pop-ups in your online banking window, sending you ‘scam alert’ messages hiding malware, or faking retailer websites to make you input your financial details.

They contain vital security updates which help protect your device from viruses and hackers. Security updates are designed to fix weaknesses in software and apps which could be used by hackers to attack your device and steal your identity. Installing them as soon as possible helps to keep your device secure.

You can choose to install updates at night when you are asleep and your device is plugged in or set your mobile or tablet to automatically update your apps when you are connected to Wi-Fi and an update is available. You can also set laptops and desktops to automatically install software updates when an update is available.

There are many different fraud and scam types not covered here. The links below offer helpful advice and information:

Little book of big scams – Metropolitan police
Investment scams – ScamSmart

Why should businesses be concerned?

Fraudsters are turning to more sophisticated methods of scamming people and businesses out of money, with businesses increasingly a target. A common tactic they may use are sending spoof emails impersonating a senior member of staff and trying to deceive employees into transferring money. The email usually requests an urgent payment is made outside of normal procedures, often giving a pressing reason such as the need to secure an important contract.

Criminals can also pose as regular suppliers to the company or organisation and make a formal request for bank account details to be changed. This is known as invoice fraud and fraudsters may trick a company into changing their bank account payee details for a sizeable payment.

Criminals who specialise in invoice fraud are often aware of the full details of the relationship between companies and suppliers – they know when regular payments are due and, equipped with sophisticated information, they make contact with finance teams within companies and pose convincingly as suppliers.

Similarly, through mandate fraud criminals convince firms to change a direct debit, standing order or bank transfer mandate by pretending to be an organisation the business makes regular payments to, for example a subscription or membership organisation or supplier.

A recent FFA UK study has shown:

• Almost 7 in 10 business leaders admitted they hadn’t taken any action to protect their business and employees from an incidence of fraud.
• A quarter of businesses have admitted they have fallen victim to scams or had scams attempted.
• Almost half of all business leaders surveyed do not believe an act of fraud will be committed against them.
• The most common targets for fraudsters are senior management and business owners in SMEs (67%).

CEO spoofing

If you receive an email from your CEO or some other senior member of staff asking you make an urgent payment outside of normal procedures, don’t automatically follow their lead.

It’s become very easy for fraudsters to manipulate the characteristics of an email, including the sender address, so that it looks genuine, but when you transfer the money, it goes straight to an account controlled by a criminal.

Keep an eye out for any emails that might be written in a different style to usual, and always check any unusual payment requests directly, ideally in person or by telephone, to confirm the instruction is genuine.

Invoice fraud

It’s not hard for criminals to investigate business invoice details (even down to payment dates) and then pose as regular suppliers. If a supplier contacts you to make a formal request for bank account details to be changed, always verify with that supplier using their on-file details.

It’s important that everyone inside a business is warned of the dangers of invoice fraud, and that everyone knows to always check invoices to identify potentially fraudulent transactions as soon as possible.