Mandate fraud losses approach £100m in 2018/19

Businesses are being warned about the dangers of mandate fraud after figures revealed that reported business losses reached almost £100m in 2018/19.

According to the data obtained by RSM from the UK’s national fraud and cyber-crime reporting centre, businesses submitted 3,577 reports about mandate fraud in 2018/19 which totalled £99,283,213 of losses and an increase of 28 per cent from the previous year.

The average amount lost by each business was £27,756, representing a 24 per cent increase from 2017/18.

Akhlaq Ahmed, forensic partner at audit, tax and consulting firm RSM said: “Mandate fraud is not a new phenomenon, but it’s very concerning that the average amounts lost to this type of fraud are rising sharply.

“If staff receive the right training and if the correct controls are in place, there’s no reason why these fraud attempts should be successful.

“While some larger businesses may be able to absorb the losses, for smaller companies already struggling with cashflow issues, a loss in the tens of thousands can prove critical.”

What is mandate fraud?

Mandate fraud, also known as invoice redirection fraud, occurs when an employee is tricked into changing a regular payment such as a direct debit, standing order or bank transfer, and redirects the payment to an account owned by the fraudster.

The Fraudster will typically:

• Contact the employer via email claiming to be an employee of the supplier that receives regular payments.
• Have obtained personal and business details of the supplier during phishing attacks which they will use in order to appear plausible.
• Will say that they have changed backs and that the business should update their records with new bank details

It can be some time before the scam comes to light, as it is often only noticed when the real supplier chases the payment.

Prevention

To prevent mandate fraud, businesses are advised to do the following:

• Implement training programmes for staff, particularly those in the finance function, so they are aware of the risks.
• Consider running an ethical hacking exercise to test resilience to phishing attacks.
• Verify all requests for amended payments by checking directly with the organisation or supplier in question.
• Monitor bank statements regularly and report any suspicions to the bank and the police.
• Notify the supplier organisation that has been impersonated.
• Never leave invoices or regular payment mandates on display for others to see.