UAE | General

Dubai businessman loses Dh360,000 to email hacker

Mystery suspect stalked victim online and impersonated his suppliers before pocketing the deal

By Faisal Masudi, Staff Reporter
Published: 21:04 March 4, 2013

Image Credit: Arshad Ali/Gulf News
Abdul Hamid

Dubai: A Dubai businessman has urged traders to be alert after an email hacker posed as his suppliers online to embezzle almost Dh360,000.

Abdul Hamid, a Pakistani heavy machinery dealer, said the hacker intercepted his UK suppliers’ emailed invoices for orders worth about £65,000 (Dh358,882).

Hamid instead received ‘invoices’ with the hackers’ banking details and wired the money to the UK as instructed in the emails that appeared genuine.

The ‘invoices’ and bank accounts still carried his suppliers’ names while the fake documents and messages were sent from email accounts virtually indistinguishable from those of his suppliers.

After withdrawing Hamid’s payments, the hacker vanished and his real suppliers’ original emails started coming in.

Meanwhile, trusting Hamid’s track record as a customer, the suppliers had started procedures to ship the goods to Dubai.

Comments (14)

Added 18:16 March 5, 2013

Always use LC (Letter of Credit) and LG (Letter of Guarantee) when doing trade. This will help you overcome such malpractices, with a nominal fee the banks charge.

Anonymous, Toronto, Canada

Added 16:53 March 5, 2013

No bank in UAE is willing to take the responsibility for fradulent transactions which it should in the normal course. If that is done then the customers are safe. But UAE has a different set of laws that those in other countries and therefore it is difficult even to take the banks to Court. But in India, if there is a fradulent transaction invariably lthe bank has to bear the loss. The basic logic is that unless the Card Holder uses it himself, it is not a transaction that he has made. Similarly in the case of a cheque, unless it is signed by the account holder, it is not valid as per law and the loss is that of the banks'; however cleverly it may have been forged. This is the sanctity of relationship between the customer and the banker.

Dr. KB Vijayakumar, Ph.D.,, Bangalore, India

Added 15:31 March 5, 2013

I had multiple incidents where my email was hacked and my clients advised to transfer our outstanding amount to some account in China & Malaysia just before the dates of due payments. However since our clients refused to do this transfer and referred the issue to us to verify the authenticity of this request, we were saved. Or else, in the normal course the due payments amounting to around AED.500,000 should have been syphoned.

Anonymous, Dubai, United Arab Emirates

Added 15:20 March 5, 2013

How can the bank credit the account when the details dont match, or may be the fraudster registered a company/shop with the same or identical name and opened a new bank account wih that name...very strange by the way...

Syed Ahmed Ali, RAK, United Arab Emirates

Added 14:18 March 5, 2013

I am really wondering how a professional business man can transfer big amount like this without even making a telephone call to reconfirm with the supplier before sending the payment. No bank will credit any account if the account details are not matched with the transferring bank details. I just had personal experience for even small amount less than 4000 dhs when a iussed a cheque to my friend where the bank employees knows me and him personally and still not accept to deposit this cheque in his account , why just becasue I wrote his name abed while his name abdul . while family name are same . imagine less than 4000 dhs and for two letters , local bank refused to accept. So how a big amount like this?

ali fakha, dubai, United Arab Emirates

Added 14:09 March 5, 2013

100% case of someone close to the victim - most likely a short term relationship - a girl on the side. Informally for long time people have been saying via comments , articles ,emails that there is group of women from Indian subcontinent in our good city whose sole activity is to trap rich men by posing as educated businesswomen or executives and start personal relationship then,stalk them,use black magic,steal details from their mobile (cotacts ,bbm pins,emails) do a email forwarding on their email so all their emails are auto forwarded to these women and then either blackmail or steal. The fact thief was in no rush meant she had eye on his every move and was assured she has his trust or trust of someone very close -son,brother,cousin involved in business. My advise to the victim is scan every one in office who is involved in purchase process and recent relationship of such employees with girls - you will for sure get your money back inshaallah.

Ali, Dubai, United Arab Emirates

Added 13:14 March 5, 2013

Please note that proper networking with firewall , Aniti-virus server client security , proper awareness will avoid from fraud emails. Even there might be exact websites like ISP site but the URL will be different so the best method is have a good IT person at your firm who control the complete IT to the best . Hackers cant attack when things are done right at your end . In todays world before you transfer money make sure you are 100 % passing to right direction as even email id can be made with same domain in different hosting servers using MX record transfer from one server to another. So use best email server for hosting email if your organization server is not 100 % secured.

Vinod, Abu Dhabi, United Arab Emirates

Added 11:48 March 5, 2013

When you send legitimate payment, the bank will never credit it until and unless all the details are accurate 100%, but strangely it accepts fraud payment when the beneficiary name and account number don't match! You need to have anti-spam at your email server to make sure that email originator's IP address and RDNS matches (only emails originated from authorised email server are accepted).

bassam, dubai, United Arab Emirates

Added 11:34 March 5, 2013

Yes, I have come across this kind of transaction and lost almost AED1m. We have already taken up this issue with our bankers. Businessmen should be more vigilant and make a system for transferring payments and not only depend on the email accounts. In another instance, I had almost transferred few thousand dollars through western union when the mail of my client was hacked, he has urgent requirement and asked to send the money in a different name as he could not go to the western union by himself. While was about to send this, I had got a call from my client for some other reasons, but i told him that i am transferred money, he was shocked that he didnt ask for any money and he is not in thailand, but in a different country. That call saved me. But my partner had already lost a million dirham as I said before.

nazeer, dubai, United Arab Emirates

Added 11:12 March 5, 2013

There are two major ways hacker can obtain your mail login information. One of them is by using all kinds of viruses, trojans and spyware applications. Secondly, if you are using too simple password he can simply guess it. Any way, if you change all your domain mail passwords to more complicated ones, the hacker most likely never will have access to your mail. Here is the tool you can use:"www.pctools.com/guides/password/ ".I can recommend everyone to use strong passwords, regularly change them and secure your computers with anti-virus.

Faiyaz Moda, Dubai UAE, United Arab Emirates