The scam works after you’ve emailed a client their invoice with bank account details for payment. Attackers compromise your email account and find recently sent invoices in your mailbox, copy them and update the payment bank account number to that of a “money mule”. They then send another email with the same layout indicating an updated invoice is attached.

A “money mule” is someone with a New Zealand bank account who can withdraw the funds very soon after the payment is made and send them offshore to a hacker. Sometimes the “money mule” does this knowingly, but often they’re also the victim of a scam.

Although the scam has targeted businesses mainly in the building sector, other industries should stay alert.

Consumer Protection and accounting software company Xero have advice on reducing the risk of fraud or email accounts being compromised.

Improve your email security

If your email provider offers Two-Factor or Multi-Factor authentication (2FA/MFA) make sure you use it. This adds another layer of protection to your email account that makes it much harder for attackers to get access, even if your password is compromised.

Check the account number

Tell customers to check with you in person — and not by email — any invoice with a new payment bank account number.

Look for signs

Tell customers to think twice about invoice double ups and check for obvious signs of a scam, eg:

• an unusual sender’s email address
• spelling mistakes 
• demands for payment by a certain date 
• signs the email is different from ones they usually get from you.

Report it

If a customer has made payment to a fraudulent bank account, tell them to report it to their bank straight away, making sure the issue is escalated to the bank’s fraud team. Also advise them to tell the police.

Xero customers

If you’re a Xero customer, send an email about the scam to support@xero.com. Include the bank account number from the fake invoice. Xero has procedures in place with the fraud teams of New Zealand banks to notify them of accounts being used for fraud. This is useful even in cases where no payment is made to the fraudulent account — banks are often able to identify the "money mule".