Email is the latest tool to be hijacked by fraudsters
Cybercrime is a growing trend and sophisticated email scams have resulted in some companies suffering financial losses in recent years
Email has become a major communication tool in the modern office but smart fraudsters are increasingly using it to cheat people out of money.
Richard Hudson, a partner at law firm Deacons who specialises in litigation and fraud investigation for commercial clients and the Securities and Futures Commission, said email scams and fraud had become a growing trend in recent years, with some companies suffering financial losses as a result.
According to a report by the Centre for Strategic and International Studies last year, cybercrime is growing, with the estimated annual cost to the global economy now standing at more than US$400 billion.
Hudson discussed the latest trends in email scams and how companies can reduce their losses from such activities.
Email scams have been the most common type of commercial fraud lately.
There are some fraudsters who create emails that appear to have been sent from the personal email accounts of senior executives in the companies.
The fake senior executives instruct accounting departments to tell staff to transfer funds to overseas accounts secretly. The accounting department staff are told that the funds are for a secret project. Sometimes, the fraudsters even telephone the accounting staff and pretend they are company executives and confirm the transfer orders. Some companies have lost money as a result of these types of scam as funds were transferred to overseas banks accounts.
Banks have also become targets, with some bank staff receiving emails from fraudsters who pretended they were customers of the bank. These fraudsters are very technology savvy and they use sophisticated software to make the bank staff believe they are interacting with customers through emails and telephone calls to convince them to make the transfers.
Even law firms have been targeted by scams. Law firms can receive emails from someone claiming to be owed money by their spouse as part of a divorce settlement. They say they want the law firm to recover the settlement funds for them but in fact it is fake and the fund transfer is money laundering as the money is being "cleared" through the law firm's accounts.
We also have to be careful and check background information and do reporting on our clients' funding too.
These fraudsters are very sophisticated and they operate internationally. Some of these email scams transfer money outside Hong Kong online or electronically, so that is very quick.
If the companies find out about the fraud quickly that can help as we can get the police or the court to freeze the money and recoup the funds. If the money is transferred outside Hong Kong, it can be harder to retrieve the funds.
We would advise companies to introduce some simple measures that could stop these types of email scam.
There should be supervision to make sure fund transfers of large amounts can not be done by a single staff member and instead require approval from a supervisor.
Education is important. For example, companies can tell their staff to check the spelling in emails sent by senior executives to identify potential fake emails. Many of these fake emails use the names of senior executives but have slight differences in the spelling. If staff members are well trained to prevent fraud, it will help reduce losses suffered by the companies they work for.
It is necessary to check or monitor staff emails to prevent fraud. Companies that have informed members of staff about monitoring as part of IT policies should not have any privacy problems.
Going back 10 or 15 years, it was easier to check on staff email, but now it is more difficult as people may now use smartphones to check personal email or use WhatsApp to communicate.
As such, companies have to identify other patterns or signs that may indicate that fraud or bribery is taking place.
For example, if a department has a high turnover but no profit, checks should be made to identify potential cases of fraud or payments of kickbacks. If a member of staff always uses the same supplier it might be an indication that bribes are being paid.
Reporting to the police would be the most natural step as the police have the power to freeze funds and can help companies to recoup money.
But companies need to be aware that once they report the case to the police, they have no control over what happens next as the police will decide if they want to prosecute or not.
For some civil level fraud, companies can decide to negotiate and settle with members of staff.
The Securities and Futures Commission may also reach a settlement with its licensees and may not always go to the police.
Background checks are important. Companies can use Google, Facebook or Twitter to carry out checks on the backgrounds of job applicants to make sure they have the experience and qualifications they claim. Companies can also make telephone calls to referees who have worked with the candidates before.
Potential fraud investigators need to like asking questions. They must also like to communicate with customers. They need to respond quickly as timing is important with fraud or scams if you are to recoup money for your customers. Sometimes other knowledge such as forensic accounting would also help.
