SCAM ALERT – Direct Deposit Scams
In the past couple of days, a number of our clients have reported attempted and successful direct deposit/impersonation scams.
In each case, a bad actor sends an email to the person presumably responsible for updating direct deposit information (eg: admin, HR, accounting, owner). The display name on the email impersonates an employee of the organization. In the message, the “employee” asks to update their bank routing and account numbers because they are “having trouble with their current bank account.”
The actor’s goal is to receive the next payroll deposit for that employee.
What you can do to avoid being scammed:
1) Email is not natively secure. Never send or accept sensitive financial information via unencrypted email.
2) Check the email address. Is the actual “From” email address a known good email address for that employee?
3) Revise your SOP for updating direct deposit account numbers to include verification measures. Call the employee using a known good phone number. Perhaps require them to provide a voided check.
4) As always, enforce multifactor authentication (MFA) on company email accounts in order to prevent business email compromise (BEC).
Please make sure this information makes it to the people who have authority to update direct deposit information for your organization.
We are here to help. If you need guidance when sorting out these types of attacks, or if you’d like to offer training to your team so that they’re prepared to ward off emails like this, please contact us today!
Stay vigilant!
Brian