Cyber criminals use fake domains to scam businesses

Cyber fraudsters are registering domains that appear to belong to UK universities so they can defraud supply companies, according to Action Fraud, the UK cyber crime reporting centre.

These domains are used to contact suppliers and order high-value goods such as IT equipment and pharmaceutical chemicals in the university’s name.

Suppliers receive an email claiming to be from a university, requesting a quotation for goods on extended payment terms. Once the quotation has been provided, a purchase order is emailed to the supplier that is similar to a real university purchase order.

The purchase order typically instructs delivery to an address, which may or may not be affiliated with the university.

The items are then received by the criminals, but no payment is ever received by the supplier, with fraudsters impersonating one particular UK university estimated to have netted around £350,000 worth of goods in this way.

Pauline Smith, director of Action Fraud said this this type of fraud can have a serious impact on businesses, which is why it is so important to carry out all the necessary checks, such as verifying the order and checking any documents for poor spelling and grammar.

“We know that there is a lack of reporting by affected companies and without this vital intelligence, a true picture of this type of fraud cannot be reflected,” she said, urging any company that has been targeted in this way to report it to Action Fraud.

Official statistics show that cyber crime is on the rise in the UK, but the size of the problem in the business world is really unknown because not all victim organisations are reporting incidents. For this reason, UK law enforcement is encouraging all businesses to report cyber crime as soon as possible, regardless of the size of the organisation.

To combat this type of fraud, commonly known as European distribution fraud, Action Fraud is advising suppliers to verify and corroborate all order requests from new customers using telephone numbers or email addresses found on the organisation’s website, not the details provided by email.

If the order request is from a new contact at an organisation that is an existing customer, Action Fraud advises that suppliers verify the request through an established contact.

According to Andy Norton, director of threat intelligence at security firm Lastline, this type of cyber criminal activity is similar to business email compromise (BEC) attacks, except that, impersonation not compromise has taken place.

In BEC attacks, fraudsters typically gains access to a corporate email account and spoofs the owner’s identity to defraud the company or its employees, customers or partners of money. The FBI recently warned that global losses related to BEC scams have risen by 136% since December 2016 and global losses in the past five years are estimated at more than $12.5bn.

In this variation of BEC attacks, Norton said the best defence is to have robust policies and procedures that ensure a second pair of eyes validates business transactions and the shipment of goods, services or payment.