Frauds try to use unpaid invoices in phishing emails

The National Cyber Security Centre, part of Traficom, the Finnish Transport and Communications Agency, has become aware of several cases in which Finnish organizations have been targeted with preparations for invoicing fraud.

The National Cyber Security Centre says that criminals use mass emails to inquire about organizations’ unpaid invoices sent to other organizations. The emails ask businesses to send the invoices in PDF form to the frauds.

“By phishing for information, the criminals aim to prepare future crimes. All parties to payment transactions should be careful about what information they disclose and to whom,” Samuli Könönen, a data security specialist at the National Cyber Security Centre, says in a press release.

The National Cyber Security Centre says that criminals’ goal is to get unpaid invoices and information about the parties to discussions about those invoices. When criminals get the invoices, they can modify them. The aim is to steer the payments to accounts operated by criminals. In addition to forging real invoices, the criminals can also ask for payment of a completely fabricated invoice.

The National Cyber Security Centre says in a press release that businesses should ignore suspicious emails. You should never try to verify the authenticity of messages by replying directly to the sender. Instead, you should contact them by calling or emailing an address you are certain is genuine.

Sample phishing email

Dear Sir/Madam,
We ask you to send all invoices which you are still owed by Organization XYZ. Because some of our team members are on leave at present, we ask you to reply with the name and email address of our colleague with whom you’ve been in touch in our organization.
To process your invoices faster, we ask you to send them in PDF form, where possible.
We thank you in advance for your support and fast response.
Yours sincerely,

Are you a Suomen Yrittäjät member yet? Read more about member benefits and advantages!