As part of the international cooperation between FIUs as fostered by the Egmont Group, the Local FIU in Luxembourg (CELLULE DE RENSEIGNEMENT FINANCIER -CRF) produced a report on the different methods and typologies involved with fraudulent wire transfers or fraudulently induced payments.
In this offence, the intention of the criminal is to gain access to funds, by inducing unaware employees to produce payments to accounts which are controlled by the criminals.
The following are some known typologies: An initial, confidential and urgent contact is made. The criminal will either pretend to be a high ranked official of the company (CEO Fraud) a Client (False invoice) or a public authority (false economic measure).
In of the mentioned cases, the employee will be asked to produce immediate (and in many cases confidential) payment in order to facilitate an important business or to comply with an delayed invoice or to pay an enforcement measure which otherwise will significantly affect the company.
The technique used by the criminals may vary, but in several reported cases, it will be either a fraudulent communication (invoice, request for payment, email or phone call) indicating that an urgent and confidential business is about to happen (or that a penalty will occur for delayed payment) and therefore a transfer is required immediately.
The working group noted that recognising and reporting the fraudulent payment may take quite some time, making very difficult to follow the subsequent transactions which use the global system to divert and distribute funds beyond the range of authorities.
In order to facilitate detection, the report includes some indicators, such as:
- The account number for payment has changed prior to this payment or is only applicable to payments as from this point;
- A new beneficiary is defined for the payment (upon existing business relationships);
- The payment must remain confidential and should be executed immediately making an exception to controls;
- The principle of 4 eyes will be either not applied or applied only by an appointed person (insider – or accomplice);
- Use of Email addresses which resemble the normally used ones, but from different domains;
- The order is produced by a new employee or a new channel which was not previously agreed and communicated to the accounting team.
While in many cases the sums requested are significant, this is not the only method as some fraudulent operations are structured to collect funds by accumulation.
Investigators reported that the first 24 hours after the fact are key in order to be able to follow the assets.