A number of Australian businesses have been forced to close down due to losses sustained in a social engineered email scam, the Australian Cyber Security Centre has revealed.
The scammers have made more than $700,000 with the approach. The largest amount lost by a firm to date has been $170,000, with average losses somewhere between $30,000 and $100,000.
Using spoofed domains, emails and signature blocks of legitimate executives of universities or large Australian enterprises, the scammers approach SMEs requesting quotes and delivery of IT equipment.
If the SME responds to the quote request, the scammers attempt to gain credit by either delaying payment through excuses, or requesting payment on the invoice on 30 or 14 days credit.
Once the order is agreed, the victim organisation is directed to send the goods to an Australian freight forwarding company and handed-off to another scammer who manages the delivery phase.
“The name on the delivery contact is almost always different to the original scammer,” the ACSC said.
The scammers then attempt to scam the freight company, by providing payment through stolen credit cards or on credit.
“They request shipment to a number of different locations overseas, such as Dagenham, UK, Deira, Dubai, Kuala Lumpur, Malaysia and Singapore,” the ACSC added.
An example scam email was given by the ACSC, which appeared to be sent by the University of Sydney’s chief procurement officer, requesting a quote for laptops, projectors and drones.
Technical goods such as defibrillators and environmental, gas and electrical monitoring equipment have also featured in the scammer’s requests. One spoof domain change used lendleases.com.au instead of lendlease.com.au the ACSC said.
“Once dispatched, there is little chance of recovery,” the centre noted.
The ACSC warned SMEs not to trust cold callers and to do due diligence on new customers.
“Always check the domain; contact the company by phone and confirm the order and the contact are genuine; check the Purchase Order carefully, there are often obvious mistakes; validate the customer before providing any credit; and confirm that the delivery address is a genuine address for that company,” they said.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.