The Royal Canadian Mint, which produces Canada’s coins, nearly sent an employee’s paycheck to an attacker following a spear phishing attack, CBC News reports. The attacker sent an email to the Mint’s HR department while posing as an employee and requested that the department change the employee’s bank account details. The HR worker who received the email was convinced, and they changed the employee’s direct deposit information.
Fortunately, the bank rejected the payment before it was sent to the scammer, so the employee didn’t lose their paycheck. The scammer did receive the employee’s pay stub, however, which contained some sensitive personal and financial information. The employee later fell victim to identity theft and was affected by fraudulent credit card purchases, although the Mint says there’s no evidence that those incidents are a result of the data that was lost during the payroll spoofing attempt.
While the bank caught the fraudulent payment in this case, Jeff Thomson, a senior RCMP intelligence analyst with the Canadian Anti-Fraud Centre, told CBC News that payroll spoofing scams are increasing.
“Oftentimes it can result in significant losses,” Thomson said. “It typically falls in our top two in terms of dollar loss in the amount of money that the victims can lose.”
Thomson continued, saying it’s tough to hold the scammers accountable because they’re often located in another country.
“So the tactics the fraudsters employ certainly make it more difficult to track them down,” he said. “And it’s challenging in investigating when you're crossing jurisdictions.”
These types of attacks depend on ignorance to succeed. If the HR worker had been trained to be on the lookout for payroll diversion attempts, they might have been more careful. The employee was lucky not to lose their paycheck, but they still lost sensitive information through no fault of their own. New-school security awareness training can teach your employees about the tactics used by scammers so they can recognize these techniques when they encounter them.
CBC News has the story: https://www.cbc.ca/news/politics/mint-spear-phishing-scam-1.5392036
