Abu Dhabi Police warns businesses of email payment scam

Abu Dhabi Police has warned companies about a fraud scheme involving fake emails that impersonate legitimate beneficiaries and business partners and ask businesses to change bank account details and transfer payments or outstanding amounts to new accounts.

Police said fraudsters exploit genuine business correspondence to make requests for changes to bank details appear legitimate. As a result, payments may be transferred to fraudulent accounts, with the scam often discovered only after the transaction has been completed, potentially causing significant financial losses.

Abu Dhabi Police urged companies and institutions to exercise caution and avoid making financial transfers based solely on emails requesting changes to bank account details. Such requests should be independently verified with the concerned entity through its official and authorised communication channels.

Companies should also verify bank account details before approving any payment.

Police stressed the importance of strengthening internal verification procedures, raising awareness among employees who handle financial transactions and correspondence, and avoiding responses to suspicious messages or the sharing of financial and banking information.

Abu Dhabi Police: Don't respond, call Aman

Abu Dhabi Police also urged anyone who suspects a fraudulent attempt or receives a suspicious message or call not to respond or transfer money.

Suspected fraud can be reported through the Aman service by calling 8002626, sending an SMS to 2828 or emailing aman@adpolice.gov.ae.

Police said such precautions can help prevent cyber fraud and protect individuals and businesses from financial losses.

What is business email compromise?

The type of fraud described by police is commonly known as Business Email Compromise (BEC) or invoice redirection fraud. It involves criminals impersonating or compromising the email accounts of businesses, suppliers or employees to redirect legitimate payments to accounts controlled by fraudsters.

The scam typically follows several stages:

• Email compromise or impersonation: Criminals may gain access to a vendor's or finance employee's email account or create a fake domain that closely resembles a legitimate one.

• Monitoring correspondence: Fraudsters may monitor emails to identify invoices, payment dates and communication between businesses.

• Fake bank account change request: Shortly before a payment is due, the fraudster sends an email requesting that the payment be made to a new bank account. The message may include a genuine invoice number or official-looking documents.

• Payment and discovery of fraud: Once the money is transferred, the fraud may not be detected until the legitimate supplier follows up on the unpaid invoice.

Warning signs to watch for

Companies should be particularly cautious when an email:

• Creates a sense of urgency or demands immediate payment.

• Comes from an email address with a small but significant spelling or domain difference.

• Asks for bank details to be changed without prior notice.

• Insists on email communication and avoids telephone verification.

• Requests payment to a bank account in a different country or jurisdiction from the supplier's usual location.

How companies can protect themselves

Businesses should never rely solely on email to verify a request to change bank account details.

Before making any changes, employees should independently contact the supplier using a trusted telephone number already on record, rather than a number provided in the email requesting the change.

Companies can also reduce the risk by:

1. Requiring independent telephone verification for all bank account changes.

2. Having more than one authorised employee approve changes to payment details.

3. Strengthening email security through measures such as DMARC, DKIM and SPF.

4. Reviewing unusual payment requests and changes in banking information carefully.

5. Contacting the company's bank immediately if a fraudulent payment is suspected and asking whether the transaction can be recalled.

6. Reporting suspected cyber fraud to the relevant authorities without delay.