P.O. identity theft/money-wiring transactions

Taking Back the ID: Identity theft prevention analysis

Don't pay that purchase order or make that money wire before reading this column. The author outlines the latest frauds — fake purchase orders to steal merchandise and innumerous money-wiring scams — and how you can prevent them.

The purchasing department of ABC University received an invoice from a well-known office supply retailer for more than $5,000 that included the "purchase" of two expensive laptops. To validate the "purchase" and prepare it for payment, an employee of the department tried to trace the vendor's invoice to a purchase order, which is required to approve and place an order, but couldn't find it. The employee then emailed department chairs and managers across campus asking them if they'd ordered the items included in the vendor's invoice. The response was an overwhelming "No." Nobody recognized the "purchase." The manager of the university's purchasing department then called the office supply retailer and told it they hadn't placed the order and hadn't received the items listed in the fake invoice.

An employee of the sales department of the office supply retailer investigated the problem by first examining the purchase order that was sent to them to initiate the order. The employee concluded that it looked very similar to the ones used by that university when they placed an order. The vendor faxed a copy of the purchase order to the university to acknowledge its receipt. A university employee called the vendor with the news that the purchase order was a fake.

The vendor realized it was a victim of an identity theft scheme appropriately called "purchase order fraud" by the FBI. It happens when a fraudster takes on the identity of an academic institution, creates fake documentation and then orders merchandise from an office supply retailer. The shipping address on the fake P.O. wasn't the university's. And the P.O. number was out of order from the other P.O. forms.

This example is fictional but represents a new scam that has taken a fairly huge financial toll on retailers throughout the U.S. — especially on small- and medium-sized office suppliers. According to the FBI, in its Oct. 27, 2014, article, Cyber Crime: Purchase Order Scam Leaves a Trail of Victims, Nigerian cyberscammers have targeted more than 250 vendors and have instigated more than 400 actual cons or attempts to steal from them. More than 85 vendors and universities have been directly affected in the scam, and it has cost them more than $5 million. According to the FBI:

• "The criminals set up fake websites with domain names almost identical to those of real businesses or universities. They do the same for email accounts and also use telephone spoofing techniques to make calls appear to be from the right area codes.
• "Next, the fraudsters — posing as school or business officials — contact a retailer's customer service center and use social engineering tactics to gather information about the organization's purchasing account.
• "The criminals then contact the target business and request a quote for products. They use forged documents, complete with letterhead and sometimes even the name of the organization's actual product manager. They request that the shipments be made on a 30-day credit — and since the real institution often has good credit, vendors usually agree.
• "The criminals provide a U.S. shipping address that might be a warehouse, self-storage facility, or the residence of a victim of an online romance or work-from-home scam. Those at-home victims are directed to re-ship the merchandise to Nigeria and are provided with shipping labels to make the job easy.
• "The vendor eventually bills the real institution and discovers the fraud. By then, the items have been re-shipped overseas, and the retailer must absorb the loss."

The cybercriminals are very adept at using social engineering to arrange to have their stolen merchandise re-shipped back to Nigeria. They use financially attractive Internet ads, emails and work-at-home or romantic matchmaking websites to fool those responding to serve as re-shippers of the merchandise.

Beware of money-wiring transactions

Western Union — and as I wrote in my last column, Beware of these recent MoneyPak scams, Green Dot — are two of the major companies fraudsters use to convince unsuspecting victims to transfer or wire funds to them.

According to the Federal Trade Commission's Using Money Transfer Services, fraudsters love using companies like these because:

• They can get their hands on the money before the victims realize they've been scammed.
• Victims can't trace the money or reverse the transaction.
• It's almost impossible to track down the scammer or identify him because he can pick up the money at a variety of locations.

Wiring money is the same as sending cash, so the sender isn't protected. It's a great mode of money transfer if you know the receiver but very risky and inappropriate when transferring money to strangers.

Next are some of the scams that the FTC says involve wiring or transferring money:

1. Overpayment Scams. You're selling an item through a newspaper classified or on Craig's List or some other online marketplace. A prospective buyer will offer to pay you with a check for more than the item, ask you to deposit the check and then wire the difference back to you at some specified address. However, by the time the buyer's check bounces, the buyer will have your money in his pocket — free and clear.
2. Winning a lottery or sweepstakes. A mailed letter informs you that you've won a foreign lottery. Included in the envelope is a cashier's check that you're told to deposit immediately, which you do. The letter also instructs you to quickly wire money back to the sender of the cashier's check to cover fees and taxes. But when the deposited cashier's check bounces, you must reimburse the bank for the money you received from them when you cashed the check. And you're "on the hook" for the money you wired to the fraudster to cover the fake fees and taxes.
3. Online purchase scams. You purchase something online, and the seller demands that you wire the money directly to him. Don't do it! Ask to use a credit card, an escrow service or some other form of payment. Or, better yet, find a different seller.
4. Advance Fee Loans. Some websites guarantee credit cards or loans regardless of credit history. But they might require that you wire an advance fee when you apply. Watch out! This might be a scam.
5. Grandparents' scam. (I've added this one to the FTC list.) Fraudsters sometimes find grandparents' social media accounts — such as Facebook and Twitter — to be lined with personal information gold. Posing as a grandchild, the conman will email grandparents to tell them he's stuck in a foreign jail and they need to wire money ASAP to a specified site, and they can't tell other family members. The grandparents are now in panic mode. Unfortunately, this scam has been very lucrative for fraudsters in the last two years and is still going strong throughout the U.S. (Read more in the July/August 2014 Fraud Magazine article, Beware of these telephone scams — victims are piling up.)

The FTC recommends that you don't wire money to any of the following people:

• "A stranger — in this country or anywhere else.
• "Someone claiming to be a relative in a crisis — and who wants to keep their request for money a secret.
• "Someone who says a money transfer is the only form of payment that's acceptable.
• "Someone who asks you to deposit a check and send some of the money back."

The Scambusters website recently reported some good news in their Oct. 24, 2014, article, 8 Money Wiring Fraud Prevention Tips:

"Money wiring services and reloadable debit cards are still criminals' payment method of choice when it comes to raking in their ill-gotten gains from scam victims. So much so, in fact, that a couple of the big money wiring companies themselves have agreed to pay compensation of $200 million to reimburse victims, and one of the leading debit card firms has announced that it will abandon its main reloadable card in 2015."

The FTC recommends, "If you've wired money to a scam artist, call the money transfer company immediately to report the fraud and file a complaint. You can reach the complaint department of MoneyGram at 1-800-MONEYGRAM (1-800-666-3947) or Western Union at 1-800-448-1492. Ask for the money transfer to be reversed. It's unlikely to happen, but it's important to ask. Then, file a complaint with the FTC.

More help for the community

I hope you'll share this information with your family, friends and clients and include it in your outreach programs. We must step up our efforts to educate the public on how to safeguard their personal information and money from fraudsters, which will help to reduce identity theft.

Cybercriminals take advantage of any opportunity to develop schemes to rob consumers and businesses of their resources. Even though they typically have the upper hand, an educated community will help curb the damage.

Please contact me if you have any identity theft issues you'd like me to research and possibly include in future articles, or if you have any questions related to this article or any other cyber security/identity theft questions. I don't have all the answers, but I'll do my best. Stay tuned!

Robert E. Holtfreter, Ph.D., CFE, CICA, CBA, is distinguished professor of accounting and research at Central Washington University in Ellensburg, Wash. He's also on the ACFE's Advisory Council and the Editorial Advisory Committee.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.Fraud-Magazine.com or ACFE.com. Permission of the publisher is required before an article can be copied or reproduced.