“FREIGHT forwarding scams” have forced a number of Australian businesses to close due to heavy losses, the Australian Cyber Security Centre says.
The ACSC has warned small to medium sized businesses supplying IT and electrical products of an email scam requesting quotes on goods.
The amounts lost average between $30,000 and $100,000 with the largest to date being $170,000.
“To date, the cyber criminals have yielded more than $700,000 through what has been termed freight forwarding scams,” the ASSC said in a statement.
“The scammers spoof domains, emails and signature blocks of legitimate executives of universities or large Australian enterprises. For example, they use lendleases.com.au instead of lendlease.com.au.”
Using an assumed identity, the scammers approach SMEs requesting quotes and delivery of IT including hard drives and laptops or technical goods such as defibrillators, equipment and even cosmetics.
If the victim responds to the quote, the scammers attempt to gain credit by either delaying payment through excuses, or requesting payment on the invoice on 30 or 14 days credit.
The ACSC provided an email scam example:
Hello sales
Good Morning. I am XXXXXXXX, the University of Sydney chief procurement officer. On behalf of the University I request the quote of the following item(s).
HP Elitebook 840 G3 14” Intel i7 8GB 512GB SSSD Touch Win 10 Pro (V6D70PA) SKU: V6D70PA
BenQ mh534 Eco-Friendly 1080p Business Projector SKU: 13BQMH534
DJI Phantom 4 PRO+ 4K UHD Drone SKU: DJI-PHNTM-4-PRO-PLUS
DJI Inspire 2 Drone (Single Remote) SKU: 3495036
Please present your quote with your company letter head.
The University term is NET 30 with Purchase order (PO).
The victim organisation is then directed to send the goods to an Australian freight forwarding company and handed to another scammer who manages the delivery phase.
The ACSC recommends:
- Ensure due diligence on new customers – don’t trust cold callers
- Always check the domain
- Contact the company by phone and confirm the order and the contact are genuine
- Check the Purchase Order carefully; there are often obvious mistakes
- Validate the customer before providing any credit
- Confirm that the delivery address is a genuine address for that company
- If affected, go to ReportCyber and report it.
