# MA-535.112015: MyCERT Alert - Fake Account Number Commercial Fraud

**Date:** 18 Nov 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-535.112015  
**Advisory ID:** MA-535.112015

---

#### **1.0 Introduction**
MyCERT has been receiving several incidents on commercial fraud that target potential victim companies in Malaysia. The scam works by sending an email to victim purportedly from supplier informing of a new bank account number for victim to make payment. The email looks unsuspicious as it uses domain name that looks very similar to supplier. This happens after victim company receives invoice from the supplier. The supplier is normally foreign-based and the victim companies are normally locals.
The inexperienced and untrained staff on security awareness may believe the fake email and proceeds to make payment to the fraudster account without realizing it is a fake account. This results in huge loss of money to victim company when supplier informs they have not received the payment, as the money has been paid to fraudster account.
**2.0 Impact**
- Huge loss of money and revenue to victim company
- Affect commercial growth of business companies
- Ruin and tarnish the business image of the affected company
- Identity theft as confidential details of supplier is stolen and used for malicious activities
**3.0 Modus Operandi**
Figure below shows the steps involve in commercial fraud:
1. Victim company request a purchase from supplier and wait for an invoice from the supplier.
2. Victim company will receive a fake invoice from fraudster via email purportedly from the supplier with a fake account number to transfer the payment.
3. Inexperienced and untrained staff will process the forged invoice and make payment to the fake account.
4. Supplier will inform victim company that payment has not been made and victim company will say that payment has already been made.
**4.0 Recommendations**
- Be wary of suspicious activities or emails from known or unknown persons.
- User may refer the registered company for Malaysia products at Malaysia External Trade (MATRADE):
> Malaysian Exporters:
> <http://www.matrade.gov.my/en/malaysian-exporters>
> Foreign Buyers:
> <http://www.matrade.gov.my/en/for-foreign-buyers>
- Get a proper confirmation directly with the supplier on their account number before make any payments. Confirmation can be done perhaps via a telephone call.
- Call your bank immediately if you realized the transfer has been made to a fake account number.
- Employers are highly encouraged to train and provide security awareness for their employees.
- Lodge a police report at a nearby police station with details or evidents for the police further investigation.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#0b6872696e793232324b6872696e79786e687e79627f72256672) or [[email protected]](/cdn-cgi/l/email-protection#4c21352f293e380c21352f293e3862233e2b622135) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <https://www.mycert.org.my/portal/statistics?id=b75e037d-6ee3-4d11-8169-66677d694932&keyword=&year=2015>
- <http://www.connellassociates.co.uk/uploads/resources/Fraud.pdf>
- <http://www.nass.org.uk/NassNews/News3260/Commercial%20Fraud%20-%20Managing%20the%20Risk.pdf>
- <http://www.sec.gov/investor/pubs/avoidfraud.htm>