CATTLE producers and livestock agencies are being urged to double check bank account details before paying invoices, following a rise in reports of rural businesses losing substantial financial sums to online invoice fraud.

Beef Central has become aware of several cases in recent weeks where family farming enterprises have lost significant amounts of money, in some cases totalling well over $100,000.

Keith Sands, co-principal of Darling Downs rural accountancy firm Sands & Associates’, who is also a cattle producer, said a number of family farming businesses in Southern Queensland have been impacted.

Beef Central is also aware of more cases of cattle producers losing large amounts of money in North Queensland.

One producer lost more than $30,000 to a scam involving false payment on a fencing project, using a fake Westpac BSB account (032885) that has evidently been used for previous cases of fraud.

The reported cases are similar in that they involve hackers gaining access to a businesses’ email system and then monitoring over time for incoming or outgoing invoices to be paid.

When an invoice appears with a financial amount of interest to them, the cyber criminals adjust the banking account details on the invoice to an account they control.

Mr Sands said it was not uncommon for family farming businesses to have limited cyber security protections in place, while also handling invoices for large amounts of money, as is often the case with livestock or machinery transactions, making them a potentially attractive target for cyber crime.

He was aware of several cases in recent months where individual farming enterprises have lost in excess of $100,000, money that is  forever lost to their businesses.

He said the recent cases should serve as a reminder for family farming businesses and livestock agencies to revisit their cyber security protections and use systems such as two-factor authentication to reduce the chances of being caught up in scams.

Mr Sands also urged people to double check bank account details directly with the other party in the transaction before executing payments.

On the positive side, he said he was aware of one local case where an agricultural business noticed that the bank account details of another business it had dealt with for many years had changed, so checked with that company and realised before paying that the banking details in the invoice had been fraudulently adjusted.

“Often it appears as a legitimate invoice, it looks legitimate because it was a legitimate transaction that actually happened, but the account details have been changed,” Mr Sands said.

“It is vital to check those bank details before you pay.”

Invoice fraud means you can still be caught out without being hacked

Markus Hugenschmidt from Jam Cyber is a cyber security expert based in Adelaide who also works with numerous agricultural businesses.

He says it is common for criminal groups to have hundreds of people working for as little as US$2 an hour in factory-type operations around the world, focusing their skills and energy on finding log-in credentials or other ways to gain access to people’s computers and mailboxes.

Once inside another person’s system, they typically observe mailboxes over months, he said. When a significant invoice comes through the bank details are then adjusted, with money transferred, never to be seen by the company making the payment again.

“Business email compromise (BEC) is an interesting cyber-crime because in most instances it is not the business affected that is hacked, but often it’s a client”, Mr Hugenschmidt said.

“This has two implications: a) because personal email accounts are not as secured as business email accounts they are more vulnerable and b) while a successful BEC causes damage to your business it’s actually not you being hacked, but your client.”

Mr Hugenschmidt said the most effective ways to prevent falling for a BEC scam are:

– have a policy in your accounts department which stipulates that payment details can only be changed AFTER the details have been verified by a phone call to a publicly listed phone number of the client in question. The manual confirmation ensures that funds are never transferred to the wrong account.

– Have an email signature which clearly stipulates that your business will never change EFT details via email, but only via letter. And that you accept the same from clients only in written form also.

– The moment it comes to payments or refunds, always be extra alert when changes are made at the last minute or payment deadlines all of a sudden move forward. Different formatting or spelling errors can be an indicator for scammer engagement as well.

“Last but not least, compare where the email has been sent from.

“Recently, the use of Doppelgänger domains has become widespread.

“A perpetrator will monitor your client’s mailbox for months and when a payment is due, they register a similar web name to yours, copy the email trail and start to communicate on your behalf. I.e. If you are @hitchrural.com.au, a perpetrator use @hltchrural.com.au (note the second letter is an l, not an i) and create a branch in a conversation.

“We have recently seen criminals working both sides, for example asking for an advance payment from the client while simultaneously asking for a refund from the business.”

Artificial Intelligence also increasing risk

Another disturbing trend, he said, is that Artificial intelligence is making matters worse.

This was because mailboxes can be cheaply monitored 24/7 for long periods at very little cost.

Also, AI can perfectly mimic the slang and word use of your business or a client and make detection harder, he said.

ABS stats in 2020 showed agriculture was among the five most likely industries to record a data breach, due to the high levels of online technology and cloud computing.

However, agricultural business were also among the five least likely industries to have invested in cyber security updates, the ABS data also showed.