Scam emails

Why charities should be cyber-aware

Government statistics* show that one in every five UK charities reported a cyber attack or breach in the previous 12 months. And the most common forms of attack or breach were through fraudulent emails. We’ve produced this guide to help you avoid falling prey.

* Source: Cyber Security Breaches Survey 2019

How do scam emails work?

Scam emails attempt to obtain sensitive information such as usernames, passwords, bank details (and money) by fraudulent means - disguising an electronic communication to look as if it's been sent from a trusted person or organisation.

Also known as 'phishing', these scams can come in many forms. For instance, criminals may impersonate a senior manager by spoofing an organisation’s email accounts, to dupe a staff member into executing unauthorised financial transactions. Some trick employees into making a payment into a fraudster’s account by claiming to be an existing supplier whose payee details have changed.

Charities are just as vulnerable to the threat of scam emails as other organisations, as one of our customers can testify. This charity received an email that appeared to be from an existing supplier, notifying them of a change to the supplier’s payee details and requesting a payment for services provided. As this was a known supplier and the email was from a recognised address, the payee details were changed and payment sent. However, this was a scam by a criminal who had hacked into the supplier’s email account and provided fraudulent bank details.

The scam was discovered when the genuine supplier chased payment. The customer alerted us about the fraudulent payment and we are in the process of attempting to recover the funds from the beneficiary bank.