Menu
Reply
Highlighted
  • 2
  • 0
  • 2
Joining in
548 Views
Message 1 of 7
Flag for a moderator

Beware of fraud from [Removed]

At work an email was received from [Removed] to someone directly in accounts who tried to get the payroll bank details changed to their own. My guess by using LinkedIn to find the appropriate individuals and tried their luck with the email address construction.

I used to be a virgin media broadband customer and am hoping the broadband security wasn't breached to obtain my work details...

Below is an excerpt from the email received.

From: [Removed]
Sent: 17 October 2019 16:00
To: [redacted for security reasons]
Subject: Paula

Hi Paula,
I opened a new bank account recently and would like to change my bank details on payroll, is it going to be effective for October pay?
Kindly get back to me if you can sort this out for me.
Kind regards,
Richard

We played along to get their account details (which we will raise with the appropriate bank to have their account closed) and they then responded with:

Here are the new account details for you to amend:
Account Name: [Removed]
Sort Code: [Removed]
Account: [Removed]
When is this months salary going out? So i can activate my direct debits on the account
Thanks,
Richard

 

 [MOD EDIT: Personal and private information has been removed from this post. Please do not post personal or private information in your public posts. Please review the Forum Guidelines]

Highlighted
  • 2.42K
  • 50
  • 72
Moderator
Moderator
517 Views
Message 2 of 7
Flag for a moderator

Re: Beware of fraud from [Removed]

Hi there, thanks for flagging this to us.

 

I have raised this to our team for investigation for you.

 

If you need anything further please let us know 🙂

 

Nathan B

The do's and don'ts. Keep the community welcoming for all. Follow the house rules


0 Kudos
Reply
Highlighted
  • 2
  • 0
  • 1
Joining in
475 Views
Message 3 of 7
Flag for a moderator

Re: Beware of fraud from [Removed]

Hi,

We also received one of these yesterday. It was spoofed from a company director to the HR Manager:

Hi  <HR PERSON>,

I opened a new bank account recently and would like to change my bank details on payroll, is it going to be effective for October pay?

Kindly get back to me if you can sort this out for me.

Kind regards,

<DIRECTOR>

Received at Thu, 17 Oct 2019 at 16:34. The director is not on Linked In so that was not the source of the info. Company is online retailer based in Stockport.

0 Kudos
Reply
Highlighted
  • 2.42K
  • 50
  • 72
Moderator
Moderator
452 Views
Message 4 of 7
Flag for a moderator

Re: Beware of fraud from [Removed]

Ah ok, thanks.

 

Was this from the same email address?

 

Nathan B

The do's and don'ts. Keep the community welcoming for all. Follow the house rules


0 Kudos
Reply
Highlighted
  • 2
  • 0
  • 1
Joining in
445 Views
Message 5 of 7
Flag for a moderator

Re: Beware of fraud from [Removed]

Yes it was.

I googled the email address and Google had already cached the original post before you removed the email address.

We have inspected the headers of the email and are 100% sure it came from that account.

Highlighted
  • 2.42K
  • 50
  • 72
Moderator
Moderator
435 Views
Message 6 of 7
Flag for a moderator

Re: Beware of fraud from [Removed]

Right ok, thanks for the confirmation.

 

Will update the team investigating this.

 

Nathan B

The do's and don'ts. Keep the community welcoming for all. Follow the house rules


0 Kudos
Reply
Highlighted
  • 18.12K
  • 1.02K
  • 7.7K
Very Insightful Person
Very Insightful Person
413 Views
Message 7 of 7
Flag for a moderator

Re: Beware of fraud from [Removed]

I'm curious to see the authentication results from the headers?

Given that as I recall - the email address included the term homeworks  Something doesn't add up - assuming my recall is correct

Tim

As a Very Insightful Person, I'm here to share my knowledge. I don't work for Virgin Media.

Click to learn more about VIP

Use Kudos to say thanks

Mark as Helpful Answer if I've helped