Almost €19 million lost by SMEs to email related scams over the past 2 years

Irish small and medium enterprises (SMEs) lost almost €19 million (€18.9m) over the past two years through email-related scams, according to new figures published today by FraudSMART, the fraud awareness initiative led by Banking & Payments Federation Ireland (BPFI). The figures come as Tánaiste Simon Harris launches a new FraudSMART SME fraud awareness campaign, in partnership with ISME and business owner and TV personality Brendan Courtney.

Invoice redirection and CEO impersonation scams remain top threats to businesses

Speaking on today’s launch and outlining the types of scams targeted at SMEs, Niamh Davenport, Head of Financial Crime, BPFI, commented:

“The scale of email-related scams targeting Irish SMEs is deeply concerning, with FraudSMART members seeing average losses of over €22,000 per incident. The majority of cases we are seeing are invoice-redirection scams, which often start with, what appears to be, a legitimate email from a supplier known to the business, but which has been hacked or closely copied by fraudsters.

They usually don’t request any payment up front but claim to have moved to a new bank account and ask for their payment details to be updated on the system for future invoices. When a legitimate invoice is issued by the supplier at a later date, the business ends up paying it into the ‘new account’ controlled by the fraudster. CEO impersonation scams, while not as prevalent, can be even more deceptive, where fraudsters impersonate a company’s senior executive in order to convince an employee to disclose sensitive information or make an unauthorised financial transaction.”

More than two-thirds of SMEs have been targeted with scams in the last 12 months, but less than half have any fraud awareness guidelines and training programmes in place for employees

Ms Davenport added: “According to a recent survey we conducted with ISME, 67% of SMEs say they’ve been targeted by a financial scam in the last 12 months, while 78% have received an unexpected or urgent request that raised suspicion. Most attempted scams are coming through email (88.4%), as well as phone calls (51.2%) and text messages (48.8%). Increasingly, fraudsters combine these channels – for example, following up an email with a phone call or text message – to create a greater sense of urgency and legitimacy.”

“Reassuringly, the majority (80%) of businesses who have received unexpected or urgent requests report taking actions to independently verify the requests before taking any action – for example, by contacting the person or organisation who has sent the request using a phone number or email address already on file, rather than using the contact details in the message received. However, of concern is that more than half (53%) of businesses report not having fraud awareness guidelines and training in place for employees, leaving their business exposed.”

Neil McDonnell, CEO of ISME, added:

“These findings are a stark reminder that fraud is now a day?to?day business risk for SMEs. More than three-quarters (77%) of ISME members who took part in the survey believe that financial fraud is a moderate or serious threat to their business. Falling victim to scams is not only financially damaging but can also fundamentally undermine trust within a business.

Employees, in particular, are often the ones targeted by fraudsters and therefore need to be supported to play a key role in fraud prevention. The good news is that prevention doesn’t have to be complicated. Putting in place simple controls such as verifying any change to supplier bank details, introducing dual approval for higher?value payments, and making sure every member of staff knows the warning signs can make a real difference.

I would encourage all SMEs to put regular fraud training in place for their workforce. FraudSMART also provides a free guide with information and tips on business fraud, and that’s a good place to start.”

Tánaiste Simon Harris launches FraudSMART SME fraud awareness campaign, run in partnership with ISME and business owner and TV presenter, Brendan Courtney

The latest findings come as FraudSMART launches a new SME fraud awareness campaign, being run in partnership with ISME and business owner and TV presenter, Brendan Courtney. The campaign is spotlighting the latest scams being targeted at businesses and offering practical fraud prevention tips through a series of social media videos over the coming days.

Speaking at the launch of the campaign, Tánaiste Simon Harris commented:

“Small businesses are the backbone of our economy, accounting for more than two-thirds of business employment in Ireland, according to the CSO. Over 92% of SMEs are what we call micro enterprises, employing less than 10 people, and while these businesses demonstrate remarkable resilience in the face of global uncertainty, unfortunately, they are often the most vulnerable to business-related fraud because they often have fewer resources and lower financial buffers to withstand losses.

It is vitally important that business owners and employees are aware of the risks that fraudsters pose and put the necessary measures in place. I welcome this FraudSMART campaign, which gives practical, free advice to help SMEs protect their money, their data and their reputation.”

Susan Russell, President, BPFI and Chief Executive of the Retail Ireland division of Bank of Ireland Group, concluded:

“Fraud is an evolving threat for businesses of every size, and it increasingly relies on deception as much as technology, creating urgency to try to bypass routine processes.

The strongest protection is to treat fraud prevention as a core part of running a business and to build a culture where staff feel confident to pause, check and challenge anything that does not look right. FraudSMART is supporting businesses with practical, impartial information on the latest scams and how to guard against them, and I encourage SMEs to visit FraudSMART.ie for guidance and resources.”

FraudSMART tips to protect your business:

—  Policies and procedures: Ensure a verification process is in place for requests to change supplier bank account details.

—  Dual authorisation: Require two people from the business to approve any third-party payment electronically.

––  Fraud awareness and training: Ensure staff are given appropriate training on email-related fraud / phishing emails.

—  Invoice checking: Review invoices thoroughly and ensure there are no irregularities.

—  Updated operating systems: Ensure that the latest updates for your computer and mobile operating systems are up-to-date, and set them to automatically update

—  Think before you post: Avoid sharing too much personal information on social media.

Further information is available at FraudSMART.ie. Businesses can also download a free copy of the FraudSMART ‘Protect your business from fraud’ guide.