Mark Jenner & Co Limited – Forensic Accounting Services

Phishing is a form of identity theft. It involves the fraudsters sending large numbers of spam emails out to unsuspecting Internet surfers. The email appears to be from a reputable source such as a high street bank. The logos being used and often the email address look genuine and many recipients consider the emails to be from who the say they are.

However, the emails use copies of the banks’ corporate letterhead. The email addresses are cloaked using sophisticated software or are so close to the real addrees that they are often accepted. For example the fradulent email could be something like: hbsc.com – at first glance you would think it came from HSBC! Please note that the example used is actually a legitimate site, simply used to show how easy a transcribed letter can fool the recipient – I am unable to disclose any real examples for obvious security reasons.

Once the unwary recipient clicks on the link on the email he or she is directed to a web site that looks to all intents and purposes like a legitimate bank web site. Invariably a request will be made to log in with security details. If you should do this you will find that your bank account is emptied right up to the overdraft limit very quickly!

I receive phishing emails from crooks that pretend to be banks that I do not even bank with – they are simply emailing as many contacts as they can in the hope that some will no doubt bank with the current bogus named bank and hopefully comply with the requests.

• It is importnat to note that no bank will ever ask by email for you to confirm your security details.

Although a number of years ago now, I was victim of a phishing email. This shows how easy it is if even a fraud investigator can be tricked into believing that an email is genuine! I was selling some bits and pieces on eBay at the time and having quite a lot of fun buying and selling items. One day I received an email telling me that I was now eligible to get “power seller status”. This was very believeable, I knew all about this acolade which gave you more credibility when selling items and I had been quite busy lately. I clicked on the link and was immediately asked to confirm my user name and password. At this stage I was not suspicious as eBay is continually asking for you to do this when you surf around their web site.

However, once I had entered these details I was taken to a web page, that still looked like an official eBay page, that asked me to enter all my personal details that eBay allready had, including my bank or credit card details! At this point I immediately logged out.

I did not think any more about this as I thought I had escaped in the nick of time! However, a few days later I received another email from eBay, telling me that they were investigating a fraud associated with my account. I went to my account and noted that there was a Harley Davidson for sale at around $3,500! Shortly afterwards my account was taken down and I could not access it again. After a further few days I received another email from eBay telling me that they had resolved the fraud, that my account had been hijacked and that I must now sign in and create a new password.

Hats off to eBay, they sorted the problem and returned some listing fees of around $40 that had hit my account for the fake sale of a motor bike. The fraudster had phished my identity to use my 100% good seller reputation to try to sell some $3500 of fresh air to an unsuspecting buyer.

I am pretty hot on phishing emails now!

It appears that the toy retailer Toys R Us is the latest big business to demonstrate how easy it is for the fraudster to attack if simple anti fraud prevention methods are not observed. Embezzlement master Paul Hopes stole some £3.7 million from the toy giant in 14 sums ranging from £101,000 to £350,000 at a time.

Over a period of around three years beginning in 2005, Hopes raised fictitious invoices for Far East toy suppliers so that he was able to arrange payment into accounts that he controlled. Yes it was as simple as that! He was a company accountant of some 23 years and the company had complete trust in him. They did not expect him to be a fraudster and therefore clearly allowed him to override any semblance of controls that should have prevented the theft.

Hopes wife of 36 years did not suspect anything. She has been devastated by the revelation that her dull dependable husband had stolen money from his employers to fund a lavish lifestyle including prostitutes and high living in the City.

Hopes will probably spend up to 8 years in jail and have a criminal confiscation of assets order made against hime that will wipe out everything he owns. In addition, Toys R Us is now attempting to recover any money that hasn’t been spent through civil asset recovery. This will mean targeting the family home and assets that Hopes may have transferred to his unsuspecting wife.

The American company has more than 1,500 stores in 33 different countries, with its New York outlet being the biggest toy shop in the world. It is surprising that such a large organisation did not have the basic anti fraud controls in place to stop this simplest of thefts! How much would it cost to implement a system of supervision and review, account vetting and credit limit monitoring? The cost of implementing and regularly reviewing such a system would be a lot less than the final bill to Toys R Us for this escapade. It was not even the company’s systems that discovered the fraud, which merrily escaped both the internal and external auditors for three years running. It was the attention drawn by one of the prostitutes used by Hopes and lavished expensive gifts upon that acted as a whistle blower on the embezzlement.

There is a mature and capable anti-fraud industry that is underutilised by corporations world wide. For a reasonable sum, experts in fraud protection and fraud detection can review systems of the smallest to the largest companies. However, it appears that these concerns would rather spend 10 times the amount investigating even larger losses when the fraudster strikes.

Most fraud experts, myself as a forensic accountant specialising in fraud included, will provide initial advice free of charge that could save you huge amounts in the long run – even if we hope to get your business!