Beware the fall from those high horses !

For all those spouting along the lines of "stupid council employees not checking" ...

It is fairly routine for suppliers to send communications to customers along the lines of "our BACS details are ..." so that the customer can pay directly into their bank account. In fact, it is expected in business these days.

It's not unknown, though not that common either, for businesses to change banks - in which case they'll send out a letter to their customers advising that "as of <date>, our new bank details for BACS payments are ...". It sound suspiciously from this story that the fraudsters have managed to fake a letter from a council supplier along the above lines - then come the next payment run, the money goes to them instead of the supplier. It would not generally raise any alarms, it's just a matter of changing a couple of numbers in the accounts package.

I nearly wrote that it's a clever attack, but to be honest, my only surprise is that it's taken so long to happen. All it needs is the knowledge of a supplier and a sample of their letterhead. Finding details of council suppliers is unlikely to be hard - after all, many of them will be driving around doing public work with their name on the side of the van !

The only difficult bit of this scam is having a recipient bank account. This needs to be a UK bank or it will raise questions, and that means having identification in order to open it. In practice, this probably involves the use of an intermediary account owned by someone who fell for a phishing attack - money goes into their account, gets transferred out of the country (possibly through other compromised accounts) and the trail gets harder to follow.