Email Compromise Scams

In our article, we are using a buyer paying a deposit as our example, but this type of scam can apply to anyone who is transferring a large amount of funds.

What is a business email compromise scam?

A business email compromise scam is when your business email becomes compromised, and is monitored for legitimate emails you send containing trust deposit details, including a BSB and account number for a sales deposit. The scammer will then immediately send another email, using your email stationery, instructing the receiver that the account details were incorrect, and that they should instead transfer the funds to the “correct” account details.

This results in unsuspecting buyers transferring their deposit to the scammers account, and in most cases the funds are not recoverable.

How does my email account become compromised?

The most common way your email account is compromised is by a scammer getting a hold of your email account username and password, allowing them to login to your account and monitor your sent items. This usually occurs from malicious email attachments, that once opened, will “lift” your account details from your computer and send them back to the scammer.

What can you do to help protect against this type of scam?

Include instructions on how the buyer can verify the provided BSB and account number, including how to contact your office on a trusted phone number. This might be instructions on how to Google your business, and find a trusted phone number on your website. A scammer can easily put a phone number into the fake email, and impersonate your office, so it is important to provide steps that would allow someone to independently verify your phone number.

Include a message on your deposit instruction emails on what to do if the buyer receives a follow up email to change the BSB or account number. You can copy and paste our example: