Gardai highlights signs of ‘Invoice Redirect Fraud’ as over €4.4m stolen this year

Businesses are urged to remind employees to treat any request to change bank account details with extreme caution.

The warning comes after An Garda Síochána revealed losses amounting to over €4.4m have been reported to them so far this year as a result of ‘Invoice Redirect Fraud’ and so called ‘CEO Fraud’.

In April this year alone, there have been numerous attempts in relation to this type of fraud with in excess of €2.2m stolen. Fortunately, An Garda Síochána, in conjunction with Financial Institutions, Financial Intelligence Units Worldwide and Foreign Police forces, have recovered in excess of €1.2m.

Criminals send emails to businesses purporting to be one of their legitimate suppliers. These emails contain a request to change the bank account details that the business has for a legitimate supplier, to bank account details that ultimately benefit the criminals. These requests can also come by way of letter or phone call so caution should attach to any request of this nature.

The criminal intention is that when the legitimate supplier next sends an invoice to the company seeking payment for services rendered or goods supplied, the victim business acts on the new banking instructions and sends the payment to the criminal’s bank account where the funds are quickly transferred or withdrawn. In many instances the business does not know it is a victim of this crime until sometime later when the legitimate supplier sends a reminder invoice for payment.

A statement from An Garda Síochána read, “Businesses must ensure that they have robust policies and procedures in place to deal with requests of this nature including escalating the decision making function to supervisory positions and making direct contact with a trusted known person in the suppliers organisation. In this context it is imperative that a suitable known contact person is identified before a business relationship commences with the supplier.

“If a business relationship has already commenced and no such checks are in place and a request of this nature is received; independent contact should be made with the supplier to verify the contents of the email. Under no circumstances should contact details contained in the email or attachments be relied upon to verify the request whether these consist of a physical address, an email address or a phone number. In that context, all existing business relationships should be reviewed without delay and defensive policies and procedures put in place.”

Invoice Redirect Fraud can impact business of all sizes and the consequences of falling for a scam of this nature can be catastrophic and may result in the closure of businesses and redundancies.

An Garda Síochána adds that all employees should receive training in relation to avoiding this type of scam.