Man arrested in La Carolina for BEC fraud: impersonated employee to claim salary
The Civil Guard identifies a cybercriminal from La Carolina who diverted a worker's salary from a Zaragoza-based company through a forged email.
Arrested in Jaén for diverting a worker's salary with a forged corporate email
A man has been located and investigated in La Carolina (Jaén) as the alleged perpetrator of an IT fraud against a company in the province of Zaragoza, according to extrajaen.com. The method used is known as Business Email Compromise (BEC), a type of fraud that consists of impersonating the identity of a trusted contact through corporate email.
The fraud, step by step
The cybercriminal sent an email to the company's finance department impersonating one of its employees. In that message, he requested that the next salary be credited to a different bank account than usual.
The finance department responded to the sender asking for a certificate of bank account ownership to validate the change. The fraudster replied immediately, attaching forged documentation that purported to verify ownership of the new account.
The company transferred the salary to the account number indicated. The fraud was not discovered until days later, when the real worker claimed payment of his salary.
At that point, both parties noticed that the original email had a domain that differed by only one letter from the company's legitimate domain. This is the technique known as "typosquatting": the minimal difference between characters had gone unnoticed throughout the entire process.
The Civil Guard investigation
Following detection of the fraud, the company filed a complaint electronically. Once received by the National Electronic Crime Reporting Office (ON-RED), the @ Team of the Cyber-Commandancy immediately began investigations and requested the blocking of the fraudulent transfer.
The specialist officers traced the financial movement and analysed the data of the receiving account. The information was cross-checked against similar cases in police databases, which made it possible to fully identify the beneficiary of the fraud.
The alleged perpetrator was finally located and investigated by the Judicial Police Team of Bailén and brought before the Judicial Authorities of La Carolina (Jaén).
Double harm to affected companies
The Civil Guard notes that this type of fraud causes a double financial loss: the company loses the money transferred fraudulently and, at the same time, remains obliged to pay the original salary to the legitimate worker.
Civil Guard recommendations
The force has released a series of measures to reduce the risk of falling victim to this fraud:
- Always verify through a second means of communication any request to change a bank account number, whether by telephone call to a known number or, if possible, by contacting in person.
- Be wary of emails that appeal to urgency, confidentiality or time pressure.
- Carefully review the sender's address, even when the message appears legitimate.
- Establish internal verification protocols before authorising payments or transfers.
- Train and raise awareness among company staff on cybersecurity and digital fraud.
Source: Google News ES — Crime (es)