Cyber related financial crime
Information about the different forms of cyber-related crime, from phishing to business email compromises.
On this page:
Cyber-fraud is the most common and changing form of financial crime affecting Scotland.
The use of technology to target both people and organisations has become more common. This can be from simple scam emails to cyber-attacks and social engineering techniques which is used to extort large sums of money from victims.
- E-mail that uses generic terms like ‘Dear account holder’
- E-mail is threatening and states that urgent action is required
- E-mail has a link you don't recognise
- Spelling errors in the e-mail
- E-mail address is different from trusted company’s website
- Unexpected e-mails from a company you have no business with
- No padlock sign on website and no 'https://' at the beginning of web address.
Keep yourself safe:
- Keep your browser software up-to-date
- Avoid risky sites, including supposed investment sites
- Never click on a link in an e-mail from an unknown person
- Use spam filters if you can
- Never give out your personal details, passwords or security codes via e-mail
- Don’t leave personal documents lying around for anyone else to see
- If you're throwing away correspondence, remember to shred it first.
Purchases made without the person's consent is one of the most reported forms of cyber-enabled fraud.
This is when a fraudster gets access to their victim's accounts or uses their payment details to take money or buy things.
These offences use different phishing techniques to get a victim’s account details. The fraudster also uses the victim’s debit/credit card or phone. They then use these to carry out transactions online.
Access can also be gained through remote access to a victim's devices. The fraudster then gets access to their accounts.
If any transactions on your account are suspicious, contact your bank/credit card company as soon as possible. You should report this and allow them to carry out an investigation.
Fraudulent sales and purchases is one of the most common forms of cyber-fraud.
Fraudster either advertise products that do not exist or agree to buy items and then not paying for them. This is done on sites such as eBay, Gumtree, Depop and Schpock.
The most common items in these scams are electronics and vehicles. Tickets are also advertised at prices below regular market prices.
When making fake purchases, fraudsters will send fake confirmations of payment to the victim of the scam. This could be a fake PayPal email.
Internet auction sites
Internet auction and private selling sites can be very useful for the public.
However, they are also the targets of fraudsters. Several thousand would-be traders fall victim every year.
These sites assist in transactions between sellers and buyers. Sellers post items for sale with terms and conditions set. Potential buyers then make ‘bids’. The person who makes the highest offer in the time wins.
Arrangements are then made for the payment and delivery of the goods.
Payment is often arranged through an escrow service. These services hold the buyer’s payment until the goods have been received and checked.
The buyer then allows the escrow service to pay the seller.
Invisible goods fraud
The buyer sends the payment, but no goods are delivered. The seller cannot be contacted as false details were given.
Using a legitimate escrow service can help protect the buyer from this type of fraud.
This can happen where the seller agrees to payment after delivery.
It can also occur if a stolen credit card is used to make payment to an escrow service. This is then not discovered until after the goods are sent.
However, this is different from the case where there is no payment made due to a dispute between buyer and seller.
Online escrow fraud
Fraudsters have created genuine looking websites which offer escrow services. This is done to defraud customers.
The seller follows instructions on how to pay their money to the escrow site. This is usually done through a cash transfer system, such as Western Union.
The escrow site then fails to pass the money on to the seller. They then can no longer be contacted by either party.
Fraudsters also use a number of other methods to get as much money as they can.
Escrow fraudsters can commit invisible goods frauds. They can also contact the losing bidders for genuine auctions, claiming to be the seller with a similar product for sale.
In both cases, the fraudster insists that payment is made through their fraudulent escrow service.
Escrow fraudsters can make sure winning bids on genuine auctions for high-value goods. Again they insist that payment is made through them.
When the seller checks the escrow service, they sees that the payment has been made by the buyer. They then send off the goods (usually to a foreign address).
The seller then loses contact with the buyer and the escrow service. They then do not receive the promised payment.
Fraudsters also get victims who are selling items online, to make payments for couriers which do not exist.
The fraudster will express interest in buying, but request that delivery be made by a courier they trust. They will then request the victim make the payment to the courier.
They may claim to have sent payment for both the item being sold and the courier, alongside a fake payment confirmation. They then request that the victim pay the courier using this money.
Payments of the courier are then paid into an account owned by the fraudster. Contact will then stop.
There are a number of steps that can be taken to minimise the risks of carrying out business on the internet:
- Get to know the auction site's terms and conditions.
- Get to know the seller/buyer
- Check the auction website for feedback on this person
- Find out details, such as a permanent address and landline telephone number
- Carry out online checks to verify that information
- Ask questions about the goods
- Try to verify that a seller has the items in front of them
- Consider the payment arrangements requested
- Fraudsters will often insist on high-risk payment methods such as cash, cheque, wire transfer or cash transfer systems such as Western Union or Nocheques
- Consider the seller/buyer's location
- Very few internet auction frauds occur with the buyer and seller in the same police force area. Although these fraudsters do operate within the UK, they prefer to commit their frauds in foreign countries. This is because international crime investigation can be difficult
- Check out escrow services - especially if the person insists on using a particular service
- These sites are often well presented and look genuine. However, these fraudulent sites may have a number of spelling and grammar mistakes.
If you do find yourself a victim of internet auction fraud, report the fraudulent transaction to the internet auction site itself. You should then contact your local police office.
Fraudsters can hack social media and email accounts. This is done to impersonate trusted friends and family.
Fraudsters will gain control of accounts, predominantly Facebook, and message the account’s contacts asking for money.
If you are contacted by someone claiming to be a friend or family member through a social media site, contact them using something else, i.e. by telephone, before agreeing to give them money.
Through romance fraud, fraudsters can get large amounts of money from victims over a long period of time.
Contact with victims is usually made through dating apps. The fraudsters then get into a relationship with the victim.
They will pretend to be someone living or working overseas. They will then request money from the victim to pay for flights to the UK to visit the victim, medical bills or legal issues.
These requests will often be repeated over a long period until the victim realises it is a scam.
This is where victims are called from someone pretending to be from some sort of technical support. This could be a representative from their Internet Service Provider or Microsoft.
They may also have a pop-up message appear while looking through internet. It will claim there is an issue with their PC and that they must contact a number to fix it.
Fraudsters will claim there is a fault with the device or internet (slow internet speeds, malware, system updates). In order to fix the problem, the victim must allow them access to their device. This is done by installing various programs.
The fraudster then gets access to the device. They then get access to the victim’s banking accounts or get them to make payments for fake services.
They then install malware on the device such as spyware and are able to get further details from the victim.
Investment scams are the most profitable form of cybercrime affecting Scotland.
These scams get victims to make payments with a promise of unrealistic returns on investments. They will then have to make further payments towards fees and taxes.
A large number of these scams use cryptocurrencies. They will get the victims to invest in new cryptocurrencies or to buy bitcoin. There will be a promise that it will increase in value.
The most common form of blackmail scam is when the criminal sends an email claiming they have filmed the victim looking at pornographic material online.
They say that they will release the video if the victim does not pay them money.
These threats are false. You should not respond to any of these threatening emails.
Business email compromise is one of the biggest frauds in Scotland and throughout the world.
These frauds can have a devastating impact on victims. They threaten businesses and can take many forms.
Invoice Fraud is where fraudsters use a compromised business email account to send a doctored invoice for services. They request that the payment is sent to an email account controlled by them.
Wage diversion is where fraudsters use an employee’s compromised email to contact a company's HR or finance department. They request a change of bank details so they can take that person's wage payments.
CEO fraud is where fraudsters pretend to be the CEO or a high ranking executive in a company. They request that an employee pays them money.
Solicitor/accountant – Fraudsters can also pretend to be a solicitor or accountant and get their clients to transfer money to them.
Individuals and organisations should make every effort to protect themselves by keeping their firewalls/internet security up to date.