Fraud Awareness and Keeping Safe Online

Impersonation fraud and Phishing fraud is an attempt by a fraudster to convince you they are a trusted organisation (this could be claiming to be Gatehouse Bank, HMRC, law enforcement, a friend or family member etc). The fraudster tries to gain your trust in order to convince you to carry out a particular action. This can include:

• Sharing information such as your personal information, security details and passwords or bank account details. This can fall under Phishing, Vishing, Smishing
• Make a payment/bank transfer for a fictitious reason (i.e. outstanding payment/bill)

Phishing: Sending of emails or other messages posing to be from trusted organisation to convince a person to divulge amongst other things, personal, security and account information.

Vishing: Also known as Voice phishing, where phone calls or voice messages are used to convince a person to divulge information.

Smishing: Similarly, this is where text messages are used to convince a person to divulge information.

Examples of this type of fraud include:

• Claiming to be your Bank requesting an urgent payment to an unfamiliar bank account (this also falls under Authorised push payment fraud)
• Claiming to be a familiar organisation advising that your direct debit has failed and they require you to update your bank details.
• An unexpected email from HMRC advising you that you need to make an urgent unpaid tax payment. The email address where the email has come would not be affiliated with HMRC and there may be a website link in the email which takes you to a fictitious HMRC website.
• Social media messages from someone who seems to be a friend or family member requesting you to urgently send them money due to debt, becoming unemployed, being stuck aboard etc. Here the contact is made from a fake social media account impersonating a friend or family member or the actual friend or family members social media account could have been hacked.

Examples of common fraud tactics include:

• Impersonating your bank to request urgent payments to unfamiliar accounts (Authorised Push Payment fraud).
• Pretending to be a known organisation claiming your direct debit failed and asking for updated bank details.
• Fake emails from HMRC demanding urgent tax payments, often from unofficial email addresses and linking to fraudulent websites.
• Social media messages from accounts posing as friends or family, urgently requesting money due to emergencies like debt or being stranded abroad

Signs of possible Impersonation and Phishing fraud

• The contact seems extremely urgent and can come across as pressurising including placing emphasis on your money being at risk if you do not follow the instructions given.
• The email address, telephone number, website, or social media account is not familiar or slightly different to what you recall.

How can you protect yourself?

• Stop and think, does this seem genuine?
• Avoid disclosing any information.
• Do not click any website links provided
• Contact the apparent trusted party/organisation via contact details which you a familiar with to verify authenticity.

Identity theft is where a fraudster illegitimately attains sufficient personal information i.e. name, date of birth, address, employment, bank account information etc to use to commit fraud. Means to acquire this information can include physical theft of data, documents, hacking or phishing. This information is then often used to commit fraud for financial gain such as to:

• Make credit applications.
• Obtain credit cards and purchase high value items.
• Opening bank accounts to move criminal funds
• Attain mobile phone contracts.

How can you protect yourself?

• If you are not sure, then do not disclose any personal/sensitive information online.
• Be cautious when providing personal information to third parties particularly to when receiving unsolicited phone calls, emails, and visits to your home (e.g. door to door salespeople).
• Do not write down your passwords and security information and do not disclose these to others.
• Keep personal belongings such as mobile phones, laptops, diary, paperwork/documents out of sight when you are out and about.
• If you believe your personal details have been compromised, contact your Bank, Action Fraud and consider adding your details to the Cifas Protective Registration scheme.

Remote access fraud often involves a fraudster contacting you online (i.e. chat, pop up message), email or by phone claiming to be from your Bank, IT Security company or your Internet provider advising you to give them remote access to your computer, tablet or phone device.

The fictious reasons they give for this include your device or online banking has been hacked, has a virus or security breach and in order to resolve the issue they need access to your device.

The fraudster instructs you to click a link or go to a particular website. This can include downloading software which is posed as an anti-virus or security software but is in fact a means for the fraudster to gain access to your device. Once a fraudster gains remote access of your device they can:

• Access your online bank account and withdraw funds.
• Steal your personal and sensitive information.
• Hack your email accounts and social media.

How can you protect yourself?

• Do not allow unsolicited third parties to gain access to your devices.
• Never download any software from unknown sources.
• Be aware of scare tactics used by fraudsters to pressurise you to give them device access e.g. suggestions that all the funds in your bank account will be lost if you do not quickly give them remote access.
• Never feel obliged to agree to any requests.
• Only install software or grant remote access to your device if you’re asked by someone you know and trust, such as a friend or family member.

A Money mule is an individual who receives illicit funds into their bank account from a criminal to move these funds through the banking system in return for a monetary gain. The goal for the criminal is to protect themselves from being affiliated with the criminal funds in the event of law enforcement intervention. Often the person receiving these funds (the mule) is unaware that these are criminal funds and believe the receipt of the funds is part of a legitimate source of employment/income. Factors which could suggest possible Money Mule fraud include:

• Fictitious job adverts via social media presenting ‘easy money’ schemes, ‘money making side hustles’, payment processing.
• Opportunity to make large sums of income with only a few hours of work.
• A high level of ambiguity on the origin of the funds.
• No clear objective on the purpose of the apparent job role.
• The need for your personal account to used as part of performing the job.
• The need to open a bank account and give the ‘employer’ access to the account.

How can you protect yourself?

• If it is too good to be true, then it probably is.
• Stop and think, does the apparent salary/wage seem unrealistic?
• Stop and think, a genuine employers/business would not require you to use your personal bank account to move funds.
• Research the apparent employer before providing personal and bank account details.
• Do not give other parties access to your bank accounts.

As the development and use of AI continues to grow so does the sophistication of the fraud. Latest trends have seen Fraudsters using AI to produce fictitious correspondence including emails, videos, websites and clone voices. This is also known as ‘Deepfakes.’ Examples of AI being used for fraud includes:

• Receiving convincing emails from the Bank or others that you have dealings with making requests to divulge personal and sensitive information.
• Phone calls which seem to be from known parties making usually urgent requests e.g. Bank staff member requesting you to urgently transfer funds to a particular account as your make account has been compromised.
• Fictitious videos on social media of known individuals introducing apparent investment opportunities, exclusive offers, discount rates etc with links to fake websites.

How can you protect yourself?

• Stop and think when receiving unsolicited contact, particularly when they entail unusual requests.
• Contact the apparent organisation directly by contact details you already have to verify the request being made.
• Check if the email address, number or website are the genuine details for the apparent organisation.