Spot & Stop Payment Diversion Fraud: Protect Your Funds

What Is Payment Diversion Fraud and Why Is It Dangerous?

Payment Diversion Fraud is a sophisticated form of cybercrime where scammers trick individuals or businesses into sending money to a fraudulent bank account instead of the legitimate recipient. This scam often involves criminals impersonating a trusted entity – typically a supplier, contractor, solicitor, or even a senior executive within your own company – and then requesting a change in bank details for upcoming payments. The danger lies in its insidious nature: by the time the victim realises their payment hasn't reached the intended party, the money is often long gone and untraceable.

According to Action Fraud UK, this insidious crime resulted in staggering losses, with victims losing over £101 million in the last financial year alone. We've analysed hundreds of such messages and incident reports, and the common thread is always the exploitation of trust and communication channels through social engineering. This isn't just about losing money; it can disrupt business operations, damage relationships with suppliers, and cause significant emotional distress to individual victims, often leading to identity theft if personal financial details are also compromised.

How Does This Scam Work? (Step by Step)

Payment Diversion Fraud typically unfolds through a series of carefully orchestrated steps, leveraging social engineering and sometimes technical exploits:

1. Initial Reconnaissance and Infiltration: Scammers often start by researching their targets. For businesses, they might monitor public information, hack into email systems (a form of Business Email Compromise - BEC) or use phishing attacks to gain access to email accounts. This allows them to monitor ongoing communications, understand payment cycles, and identify key personnel responsible for finance. For individuals, they might monitor property transactions or inheritance processes to gather critical information.
2. Impersonation and Forgery: Once they understand the target's relationships and payment patterns, the scammers create highly convincing fake emails or letters. These communications often spoof the sender's email address or letterhead, making them appear legitimate. They might pretend to be a supplier with new bank details, a solicitor handling a property sale, or even a senior executive authorising an urgent payment, effectively performing an advanced form of impersonation or invoice fraud.
3. The "Urgent Change" Request: The fraudulent communication will typically contain an urgent request to change bank details for future payments. They might cite reasons like a "new banking system," "international transfers," or "updated accounts." The sense of urgency is a common social engineering tactic designed to bypass scrutiny and prompt quick action without verification.
4. Payment Diversion: If the victim falls for the ruse, they update their records with the fraudulent bank details and proceed to make the payment as requested. Believing they are paying a legitimate entity, they unknowingly transfer their funds directly into the scammer's control via a wire transfer.
5. Quick Withdrawal: Once the money hits the scammer's account, it is typically withdrawn or moved to other accounts very quickly, often across international borders, making it extremely difficult to trace or recover. Victims who reported this scam described a chilling moment of realisation when the legitimate party inquired about an overdue payment they believed had already been made.

What Are the Warning Signs?

Spotting Payment Diversion Fraud requires vigilance and an eye for detail. Here’s what to look out for:

• Unexpected Changes to Payment Details: Any request to change bank account details, especially via email, should be treated with extreme suspicion, even if it appears to come from a trusted sender.
• Urgency and Pressure Tactics: The message stresses immediate action, threatening penalties or missed opportunities if payment isn't made or details aren't updated quickly. This is a classic social engineering tactic.
• Slightly Altered Email Addresses or Domains: The sender's email address might be one letter off (e.g., supplier@companey.com instead of supplier@company.com) or use a completely different, but similar-looking, domain. This is a common form of email spoofing or 'lookalike' domains in phishing attacks.
• Generic Greetings or Poor Grammar: While not always present, watch for impersonal greetings ("Dear Client," "Dear Customer") or subtle grammatical errors and awkward phrasing that don’t match the usual communication style of the legitimate sender.
• Requests for Confidential Information: While this scam primarily focuses on diverting payments, some initial phishing attempts might request login credentials (credential harvesting) or other sensitive information that could lead to account compromise.
• Unusual Communication Methods: If a trusted supplier suddenly requests a bank detail change via email, but they usually communicate such changes via a secure portal or a verified phone call, be wary.

Scam vs Legitimate: How to Tell the Difference

Scam Behaviour	Legitimate Organisation Behaviour
Unexpected bank detail change request via email/text only, with urgency.	Changes to bank details are rare, communicated securely (e.g., via registered mail or secure portal), and verified through established channels.
Pressures for immediate action; discourages verification via phone.	Encourages verification and provides clear, accessible contact information for any doubts.
Email address is slightly off or uses a free email service (e.g., Gmail for a large company).	Uses official, verified email domains consistently for all communications.
Often contains grammatical errors, awkward phrasing, or generic greetings.	Maintains professional, consistent language and grammar in all official communications.
Requests direct wire transfers to unfamiliar accounts, often international.	Uses established payment methods; new accounts are always verifiable through official means.

Who Is Being Targeted and Why?

Payment Diversion Fraud targets a broad spectrum of victims, primarily focusing on businesses and individuals involved in significant financial transactions.

• Businesses: Small and medium-sized enterprises (SMEs) are frequently targeted because they often have less sophisticated cybersecurity defences compared to larger corporations, making their email systems easier to compromise. They also process numerous invoices, increasing the chance of a successful social engineering attack. Large businesses can also be targeted if a senior executive's email is compromised (known as CEO fraud or Business Email Compromise - BEC). Scammers aim for high-value transactions like supplier payments, payroll, or mergers and acquisitions.
• Individuals: Individuals involved in significant personal financial transactions are also vulnerable. This includes those buying or selling property, making large investments, or handling inheritances. Scammers might impersonate solicitors, real estate agents, or financial advisors, knowing that these transactions involve substantial sums and often require wire transfers. The motivation is purely financial gain, exploiting the trust built into professional relationships and the pressure associated with large financial commitments.

What Should You Do If You Receive This?

If you suspect you've received a Payment Diversion Fraud attempt, immediate action is crucial:

1. Do NOT reply or click on any links: Engaging with the scammer can confirm your email address is active and potentially expose you to further attacks or more sophisticated phishing attempts.
2. Verify Independently: Do not use contact details provided in the suspicious message. Instead, use established contact information (e.g., a phone number from a previous legitimate invoice, the company's official website, or a trusted point of contact you have worked with before) to verify the request directly.
3. Alert Your Bank/Financial Institution: If you have already made a payment that you suspect is fraudulent, contact your bank or financial institution immediately. They may be able to recall the funds, though time is of the essence for a wire transfer.
4. Report the Incident:
   • In India: Report to the National Cybercrime Reporting Portal at cybercrime.gov.in or call 1930.
   • Globally: If you have been affected, report to your local cybercrime authority. For instance, as reported by Action Fraud UK (UK), UK victims should report directly to them.
5. Preserve Evidence: Save the suspicious email or communication as evidence. This can be crucial for investigations and helps law enforcement understand evolving criminal tactics.

How Can You Stay Safe?

Prevention is always better than cure. Here's how you can protect yourself and your organisation from Payment Diversion Fraud:

• Implement a "Call to Verify" Policy: For any request to change bank details, always verify by calling the sender on a known, trusted phone number (not one provided in the suspicious email). This simple step can thwart most impersonation attempts.
• Train Employees: Educate staff, especially those in finance or accounts payable, about the tactics used in Payment Diversion Fraud, phishing, and social engineering. Regular awareness training is key to spotting fraudulent invoices and communications.
• Multi-Factor Authentication (MFA): Enable MFA on all email accounts and financial systems to significantly reduce the risk of email compromise (credential harvesting), which is often a precursor to this type of fraud.
• Strong Password Policies: Use strong, unique passwords for all accounts and change them regularly.
• Regularly Review Financial Statements: Monitor your bank accounts and credit card statements for any unauthorised transactions to detect financial loss early.
• Use Secure Payment Portals: Whenever possible, use established, secure payment portals instead of direct wire transfers based solely on email instructions.
• Leverage ScamCheck.tech: For any suspicious message, email, or website, use ScamCheck.tech to quickly identify potential threats. Our advanced analysis tools help you distinguish legitimate communications from fraudulent attempts, providing an extra layer of protection against sophisticated scams like payment diversion and Business Email Compromise.
• Be Skeptical of Urgency: Scammers rely on creating a sense of urgency. Take a moment to pause, verify, and question any requests that demand immediate action.

Verified by ScamCheck Research Team. Source: Action Fraud UK.