Mandate Fraud happens when someone deceives an organisation into making an e-payment or transferring funds into a changed bank account of the supplier or business they are dealing with. The request to make payment is made through direct debit, bank transfer or standing order to the new bank account, and the recipient is a criminal. 

If the organisation accepts the request to change the bank details, the payment is transferred into the criminal's bank account.

Scammers purport the organisation to subscription services, or they search for the bank account details and the details related to bank transactions through various sources like an unaware or corrupt staff, publicly available contracts, email interception, online logs of the supplier contact information, websites providing contact details or email addresses for suppliers. 

In some cases, perpetrators of mandate fraud may know the victim beforehand, or the cybercriminals target procurement departments or finance staff to obtain information and learn about internal processing. They gain trust and persuade the employee to divulge certain key information. 

How does Mandate Fraud occur? 

The criminals intercept the email messages between the organisation and the supplier and access the email account details of the organisation's personnel working in financial approval roles or suppliers, or they get the details through phishing emails sent to the staff or malware on the supplier's device, or they enter the system of the organisation by stealing passwords or watching and tracking the email routines between the supplier and the organisation or tampering with the mail account when the legitimate owner is unaware.

Once the organisation's email system is intercepted, the criminals access the email accounts of those in financial approval roles or spoof genuine suppliers' email accounts. Then, the email can be redirected to an obscure location or deleted. 

An email is forwarded to the organisation by the criminals to update bank details for subsequent payment. The concerned person may fail to check the reminder emails, and the parties involved in the transaction may not realise fraudsters have contacted them. 

You get tempered invoices or misleading communication from a different email account requesting to change the bank details of the genuine supplier. The email requests you to make future payments on the changed bank details. If you transfer funds to the new account, the money is immediately transferred to a third party, cashed out, or sent abroad.

How To Prevent Mandate Fraud?

• Keep all devices and systems protected.

• Do not leave bills, direct debits, standing orders and other financial details lying around for others to look at.

• If you request to change bank details from suppliers or business partners, confirm by calling the organisation's representative or checking bank details and statements carefully to prevent Bank Mandate Fraud. 

• If you get a call requesting to change details, call back using the number from the source to confirm the recipient. 

How To Report Bank Fraud? 

Immediately report to Action Fraud if you find anything suspicious or mandate fraud has been committed, and raise concerns with the Office of the Public Guardian. 
 
As per law, in the case of Bank Mandate Fraud, banks must refund funds if the funds are fraudulently acquired. Banks have agreed to refund money transferred knowingly, for payment up to £1 million, but not in case of undue negligence or a potential attempt to defraud the banks. 

Bank mandate fraud-related refunds are made to customers, not businesses, and no extended insurance covers the loss through cyber or data theft.