Fraudsters have targeted HMRC’s Covid-19 Job Retention Scheme, creating a sophisticated scam email designed to trick SMEs into handing over bank account details.
The fraud was uncovered by the London-based Lanop Accountancy Group. The email uses official HMRC branding and purports to be from “Jim Harra, First Permanent Secretary and Chief Executive of HMRC”.
Around 50 business owners have so far reported receiving the suspicious emails to Lanop after noticing the email was sent via the address [email protected], despite its user title being ‘HM Revenue & Customs’.
The email asks for the recipient’s bank account details and includes the following message (with typos): “Dear customer, We wrote to you last week to help you prepare to make a claim through the Coronavirus Job Retention Scheme. We are now writing to tell you how to access the Covid-19 relief. You will need to tell your us which UK bank account you want the grant to be paid into, in order to ensure funds are paid as quickly as possible to you.”
Recent analysis from cyber security company Barracuda Networks has suggested that Coronavirus-related phishing emails have risen by 667 per cent since the start of March.
The scams included fraudulent communication purporting to be from the World Health Organisation (WHO) and the NHS and private health suppliers selling facemasks and other personal protection equipment (PPE).
Cyber breaches are not only increasing in sophistication and quantity, but they’re also becoming more successful
Chris Ross, SVP of Barracuda Networks warned: “It is absolutely vital that businesses have the cyber security systems in place to identify and quarantine phishing emails and ensure that every employee is properly trained to spot suspicious communication and think twice before giving out personal information.”
Meanwhile, cyber security expert Andy Harcup, VP EMEA Sales for Absolute Software, warned: “The influx of remote workers has inevitably contributed to the increasingly sophisticated phishing attempts, which we have seen grow in frequency since the Covid-19 outbreak.
“What’s more, organisations still in operation during this pandemic have invested, purchased and borrowed thousands of new devices to manage the shift to remote working. Often, these new devices are not supported by company IT infrastructure or cyber security software.
“Thus,cyber breaches are not only increasing in sophistication and quantity, but they’re also becoming more successful, as employees no longer have the cyber security software or infrastructure in place to flag or block suspected spam, malware of phishing attempts.
“Business owners must introduce these measures as a matter of priority – Covid-19 has been enough for us to worry about without the threat of a breach of personal, professional or client information looming over us.”
Email security specialist Tim Sadler, CEO of Tessian said: “Business owners must be increasingly vigilant during this difficult time, because opportunistic cybercriminals do not miss a trick when it comes to capitalising on the general public’s honesty, naivety or fear.
“Remote workers and business owners, therefore, must proactively consider the legitimacy of any email sent through to them which asks for personal information, admin credentials, or financial details. Always check the display name and email address match up and hover over URLs to make sure they are legitimate before complying with any urgent requests.”
