419ers take council for £100k
Lads from Lagos lure Lanarkshire
A Scottish local authority lost £102,000 to an African gang after being duped by a targeted letter scam.
The letter, received at the end of July, purported to come from one of South Lanarkshire Council's legitimate suppliers, and requested that payments be made into a different account.
The finance department complied, apparently without checking the request was genuine. The fraud is now the subject of a national investigation to discover if other local authorities have been similarly duped, and to attempt to trace the gang.
A South Lanarkshire Council spokeswoman said: "Forged documents instructing a change of bank details were sent to the council and used to obtain fraudulent payment of £102,000.
"We are co-operating with an ongoing national police investigation. The council are confident no member of staff is involved in the fraud."
The Council is currently facing a £55m budget shortfall. News that it had given away £102,000 to fraudsters came as its Trading Standards department warned council tax payers that any communications asking for bank details "should set alarm bells ringing". ®
Beware the fall from those high horses !
For all those spouting along the lines of "stupid council employees not checking" ...
It is fairly routine for suppliers to send communications to customers along the lines of "our BACS details are ..." so that the customer can pay directly into their bank account. In fact, it is expected in business these days.
It's not unknown, though not that common either, for businesses to change banks - in which case they'll send out a letter to their customers advising that "as of <date>, our new bank details for BACS payments are ...". It sound suspiciously from this story that the fraudsters have managed to fake a letter from a council supplier along the above lines - then come the next payment run, the money goes to them instead of the supplier. It would not generally raise any alarms, it's just a matter of changing a couple of numbers in the accounts package.
I nearly wrote that it's a clever attack, but to be honest, my only surprise is that it's taken so long to happen. All it needs is the knowledge of a supplier and a sample of their letterhead. Finding details of council suppliers is unlikely to be hard - after all, many of them will be driving around doing public work with their name on the side of the van !
The only difficult bit of this scam is having a recipient bank account. This needs to be a UK bank or it will raise questions, and that means having identification in order to open it. In practice, this probably involves the use of an intermediary account owned by someone who fell for a phishing attack - money goes into their account, gets transferred out of the country (possibly through other compromised accounts) and the trail gets harder to follow.
"The council are confident no member of staff is involved in the fraud."
Other than the idiot(s) who changed the payment details without validating the letter.
Considering the fraud
involving in Council Employee’s expenses I'm surprised they noticed the money missing.
This can't be the first time this happened... just the first time somebody has had the balls to admit it.
EPIC Fail with our money but rest assured nobody senior will lose their job over this.
100K = 10 lowly paid council workers or one executive. Who do you think will lose their job because of this incompetence?