Cyberfraudsters are targeting Northern Ireland charities
The charity concerned would prefer not to be identified. Nevertheless they are keen to share their experiences with the wider sector so as to raise awareness of the very real dangers of cyberfraud.
It can happen so easily – even to an organisation with robust financial protocols and procedures.
This is what happened:
Fraudsters had been monitoring the charity CEO’s email system for a number of weeks, presumably learning the charity’s financial systems and protocols and the CEO’s personal style of email communication. Cyber-security specialists believe that the CEO must have inadvertently clicked on a phishing email.
On the day of the fraud, the CEO had sent an email to the charity’s Director of Finance, with an invoice attached, requesting payment of a 5 figure sum to one of the charity’s creditors. It was a legitimate invoice that the Director of Finance was expecting - and the CEO had clearly authorised the payment.
This was when the fraudsters struck.
They disabled the CEO’s email system and PC so that he did not have access. They then emailed the Director of Finance to request an immediate payment and made a change to the bank details. This fake email also noted that the CEO was busy all day and not contactable.
A member of the finance team did go to discuss the payment in person with the CEO – but unfortunately the fraud was not detected at that stage because the CEO and the Finance Officer were talking at cross-purposes. The CEO could confirm that he had authorised the payment – but was not aware of the request to Finance to change some of the key details.
The fraud was picked up the next morning - and the banks were contacted immediately so as to try to prevent completion of the transfer of funds.
The banks were excruciatingly slow in their response and, by the time the fraudsters’ bank had frozen the relevant account, all the money had been withdrawn.
The charity’s insurers have since informed them that their insurance policy does not include cyberfraud.
As a consequence the charity may never recover the sum of money lost.
Almost all charities are currently under severe funding pressure - so it is particularly upsetting for an organisation to lose a substantial amount of money to fraudsters.
The PSNI have told the charity that this kind of fraud is now extremely common in Northern Ireland - and that charities and charity Chief Executives are being particularly targeted.
To reduce the risk of this happening to your organisation:
- Review your internet security
- Check whether your insurance policies cover cyberfraud and
- Provide cyber security training to all your staff.
Please contact Stephen Gray, Head of Information Management at NICVA on 028 9087 7777 or email firstname.lastname@example.org, for further information on cyber security.