Published : 6 years ago, on 04/09/2018

• Impersonation fraud is on the rise, with small and medium businesses losing an average of £27,000 to fraudsters[i]
• Six per cent of victims have had to make employees redundant due to the financial impact
• The average loss of £27,000 is nearly equivalent to the average salary in the UK[ii]
• Law firms most susceptible to falling victim (19 per cent), followed by HR professionals (17 per cent), IT workers (17 per cent) and finance companies (16 per cent)
• These scams occur when a fraudster uses the information and personal data of suppliers, bosses or business contacts and impersonates them, in an attempt to defraud a company out of money
• Get Safe Online and Lloyds Bank have published a video showing a team of CEO impersonators dubbed the ‘fraudstars’ to demonstrate the ways in which scammers can dupe companies into making payments, based on real-life scams

With one in twelve (eight per cent) of respondents having fallen victim to impersonation fraud, it is likely that nearly half a million (454,960[iii]) SME businesses in the UK have been impacted by these scams.

According to data from Lloyds Bank there has been a 58 per cent rise in this type of crime in the year to date[iv], however as this is only reported fraud, the true scale of the problem is likely to be much larger.

Sectors at risk from impersonation fraud at work

• Legal (18.8 per cent)
• Human resources (17.2 per cent)
• IT and Telecoms (17 per cent)
• Finance (15.9 per cent)
• Arts and Culture (15 per cent)
• Healthcare (8.5 per cent)
• Manufacturing and Utilities (8 per cent)
• Architecture, Engineering & Building (7.8 per cent)
• Travel & Transport (7.6 per cent)
• Education (6.2 per cent)
• Retail, Catering & Leisure (5.5 per cent)
• Other (4.2 per cent)

To raise awareness and educate workers on how to stop scammers, the bank has teamed up with Get Safe Online, the UK’s leading source of online safety information.

This comes as only 20 per cent of victims say they now think twice when receiving a request at work – and the research reveals that a lack of precautions around online safety could be assisting impersonation fraudsters. Over a third (37 per cent) of employees don’t know what to look out for or don’t have any security precautions in place – leaving them vulnerable.

Gareth Oakley, Managing Director of Business Banking at Lloyds Bank comments:

‘The rise of impersonation fraud is a very concerning issue for small and medium-sized businesses. We know that falling victim to these types of scams can be serious as the impact extends beyond just the financial implications. This is why we’ve teamed up with Get Safe Online – to help educate business owners and employees on how to recognise these scams and take the right precautions to protect themselves’.

Impact on employee wellbeing

The fallout from fraud is not just financial. Respondents revealed that the attacks caused emotional upset too. Fifteen per cent felt angry that they were targeted, with one in twelve (8 per cent) saying they couldn’t trust people close to them.

The research also found that one in 20 (five per cent) victims of impersonation fraud were so ashamed that they hid their mistake from their team, potentially with the fear of being fired on their mind. However, hiding a mistake like this may only cause further problems: if the systems have been compromised, then fraudsters may be able to get access to other critical information, or make additional payment requests meaning that losses will increase.

Victims of impersonation fraud often face financial consequences: seven per cent of companies affected said they had experienced financial hardship, with over one in twenty (six per cent) having to make employees redundant due to the financial impact of the scams.

Over half (53 per cent) of respondents say they have experienced scammers posing as their boss, demonstrating a rise in popularity of CEO impersonation fraud. A similar number (52 per cent) say they have suffered fraudsters posing as suppliers, with invoice fraud – where a false change in bank account details is sent from a legitimate-looking supplier – another common scam.

Business email compromise, where scammers intercept a legitimate email trail and change the beneficiary bank account details, is an increasingly common method of impersonation fraud, according to Lloyds Bank. This is especially dangerous as fraudsters can change information in a genuine email thread, therefore there are no other warning signs. As email is not a secure method of communication, so any change of details or financial information should always be double checked with a trusted contact.

Legal sector most at risk

Of those affected by the crime, individuals working in legal roles are the most likely to fall victim and be caught out (19 per cent) due to the high quantity of financial transactions they are involved in, followed by HR professionals (17 per cent), IT workers (17 per cent) and finance companies (16 per cent). However, finance workers are the scammers’ primary targets, with nearly one in five (19 per cent) of respondents saying they, or someone else in the finance team had been targeted by the scammers.

To raise awareness and educate workers on how to stop scammers, Lloyds Bank has teamed up with Get Safe Online, the UK’s leading source of online safety information. They have created a video where a team of CEO lookalikes pretend to be the real deal to scam unsuspecting staff out of money. These fraudsters attempt both CEO fraud and invoice fraud. In doing so they demonstrate some of the most common techniques used in impersonation fraud, including:

• Changing bank account details – where scammers pose as suppliers or other contacts and notify victims that their bank details have changed and get businesses to make payments to the fraudsters bank account (commonly known as invoice fraud)
• Phishing – sending emails, texts or voicemails purporting to be from a reputable company to get individuals to reveal personal information
• Fake emails pretending to be your boss or other senior colleagues – emails set up to look very similar to legitimate emails, which are sent to try and trick the recipient into paying funds to a fraudulent account
• Social engineering – the act of manipulating or tricking people into certain actions including divulging personal information or financial information

Speaking on how businesses and employees can avoid falling victim to impersonation fraud, Tony Neate, CEO of Get Safe Online, comments:

‘The most effective way to ward against these fraudsters is to double check the details. Verify any requests for amended payments to an organisation directly using established contact details. If you’ve received a suspicious email, always check with the person you believe sent it by asking in person, phoning them or using a different trusted communication method’.

The poll of 1,500 SME workers further reveals that tech savvy millennials face the highest risk of being targeted – with more than 1 in 10 (12 per cent) falling victim or knowing someone who has fallen victim to impersonation fraud.

To find out more, please head to www.getsafeonline.com

[i]Data from Lloyds Bank: average loss to a commercial customer for impersonation fraud is £27,000. This is the average loss per CEO and Invoice Fraud case during the time period 1^st January 2016 and 30^th June 2018

[ii]https://www.ons.gov.uk/employmentandlabourmarket/peopleinwork/earningsandworkinghours/datasets/allemployeesashetable1 Average salary is taken from Total Table 1.1a Weekly Pay – Gross, Tab: all, Mean weekly pay multiplied by 52 for the average annual pay.

[iii]Assuming eight per cent of SMEs (from omnibus research) have been victims and there are 5,687,000 SMEs in the UK. Statistic taken from: page 5, House of Commons Library, Briefing Paper, Number 06152, 28^th December 2017, Business Statistics

[iv]Data from Lloyds Bank: number of impersonation fraud (Invoice and CEO Fraud) attacks since 2017 (pro-rata)