This new customised scam gives the old fashioned con artist the full leverage of the electronic funds transfer era.

A new wave of money transfer fraud techniques is on its way to New Zealand. It is the President scam, so called because it is centred on the departure from secure procedures triggered by a very senior official in the targeted organisation intervening and giving the appearance of wanting the fraudulent transfer to take place.

Under the President modus operandi someone poses as the boss of an organisation. They then conjure up an exception of some kind and which requires an instant transfer of money. The controlling officer, the one at the receiving end of the email or telephone call, then instructs the operations person concerned to implement the transfer. Or transfers it personally.

Inherent in this confidence trick is the artificial flap and the urgency it generates, an urgency designed to wash away any remaining security steps, especially any suspicion about the entity on the other end of the money transfer.

The theme of the President scam is that it differs from other transfer frauds in that it is designed to be implemented and completed in minutes rather than hours.

However the preparatory spade-work by the perpetrator will take much longer and involves a close study of the voice and verbal pattern of the senior official, the President, who is being mimicked. It will also require an evaluation of the vulnerability of the authorisation chain and especially of the individual who will press the button on the transfer.

These weak links may include for example a command chain noted for an informal i.e careless approach to established procedures.

Also an organisation in which the boss, the President, is known for making procedural short cuts. A boss who is feared in this context represents a weak link because line staff will want to avoid incurring their ire and so be more willing to take the procedural short cut.

There are of course a number of variants on the President scam.

These include the scam artists impersonating suppliers who claim that if a certain payment is not immediately made, that they will cause, for example, a production line to close down.

A particularly nasty twist is when a known adviser, perhaps the head of an organisation’s firm of accountants appears to be ringing in, urgently advocating the settlement of this or that account before the sky falls in.

In Europe where the President scam was developed and refined there can often be a conspiratorial aspect to the impersonation in which the scam artist seeks to impersonate elements of the forces of law enforcement, and seeks the covert assistance of someone connected with money transfers on the grounds of patriotism.

The money transferred under the President scam moves quickly through the hot money arteries, bouncing around countries with low banking surveillance, before being laundered, and often factored through commodities and other merchandise.

The history of the preceding waves of electronic scamming indicates that the International fraud artists turn their attention to New Zealand when they have picked the eyes out of the low hanging fruit in the northern hemisphere.

This time, as we shall see, is about now. Neither can we claim that the President technique has not already been applied to New Zealand. It may have been intercepted. Or the victim organisation has shut up about it.

Anyone involved in money transfer knows that by its very existence any chain of authorisation is vulnerable just because humans are involved.

So we have to hold onto something solid. In this case documentary credit instruments represent the best banking landmark. This means, in this context, sight documents.

Why? Because seeing is believing. Any departure, any exception, from authorised procedure must be verified by “sighting” the individual, the President, the CEO, or the CFO who is demanding the implementation of the exception to standard practice i.e. the money transfer.

The reason that sight procedures (never in this connection ever to be confused with citing or even “site” procedures)apply now is just because unlike previous waves of point to multi point stacked scams, the President formula relies on a high degree of customisation.

This means for example that an email used in the scam will be customised around the known habits of the President and also around the known personality of the target, the officer of the organisation authorised to make the transfer.

This email may, for example, have a holiday home telephone number. “Ring me for verification.” The person at the other end of the line will be the impersonator, perhaps with a nasty cold in order to cover up any discrepancy in tonality.

It is this customisation that makes the President scam so dangerous to New Zealand organisations.

Organisations should now evaluate the wisdom of displaying and generally publicising the names of their treasury people, especially on their web sites. They are the point of departure for practitioners of the President scam.

As practitioners turn their attention to southern latitudes we find that only in the simplicity of direct sight, the face-to-face encounter, is there an antidote to this curious yet so far extremely successful blend of the old fashioned confidence trickster merged now with the speed of light of a numerical transfer.

How vulnerable are New Zealand medium to large organisations to this new threat?

Until now the publicised victims of electronic scams of all stripes have been individuals, householders.

The first wave was the Nigerian one in the fax era. Then followed a medley centred on phishing or bank impersonation. Dismayingly the banks insist on using emails to send out their promotional material which means that they cannot collectively state that any email from a trading bank is by definition a false one.

It is in this year’s wave, the telephone calls from Microsoft accredited agent impersonators that we find the direction of this new scam.

As this particular Microsoft scam developed it was observed that recipient caller display bars began to show New Zealand telephone numbers.

Though replies indicated that the caller display numbers elicited no response.

Another pointer is the arrival in the Auckland area especially of criminal gangs working over ATMs.

We are entering the era in which organisations will have to start becoming reticent about their financial authorisation chains in terms of who staffs them.

Similarly with IT structures in which any unanticipated request for tests should be flatly ignored.

At least, until the sight verification.

| From the MSCNewsWire reporters' desk - European Correspondent  ||  Tuesday 22 August 2017   |||