Email scam

[Jerry Can]

Hello,

It looks like I was scammed today for quite a large sum of money. Essentially my builders email account (hotmail) was hacked and the hacker sent emails to me requesting that we withhold payment whilst they sort out tax issues and then provided another account number to send money to. I have to say looking back at the emails you cannot tell there is anything fraudulent about them, the hacker even took the original invoice and re edited it with the new bank details. I paid for the work on completion last might, set it to go this morning, and confirmed with the builder today. That was when we found out the account had been hacked. Now we maybe lucky in that I moved fast enough to alert the bank, who blocked the account before the money was taken out - so there is a reasonable chance i'll get the money back,

However I just want to know the legalities if I don't get the money back. My builder was aware that something wasn't quite right with his emails, but not exactly what, and since being alerted today he has beefed up his security. However I'm not particularly inclined to pay again ifI don't get my money back, as I feel that actually he has been scammed, and is equally if not more so to blame, as it was his account compromised. What do the legal eagles reckon?

for the record I'm not a 94 year old grandma, but a 42 year old internet literate male.

tia.

[Innowaybored]

No idea on the legalities but I amazed that some businesses would still use hotmail/yahoo etc for business related email addresses and service.

Are these people idiots? Clearly they aren't very professional. In general small businesses security is woeful. I wouldn't trust 90% of small businesses to hold or process my data securely.

[herewego]

This has been done before. Hopefully you spotted the scam and stopped it in time, sounds like it in which case no problem. You were sent the scam email and responded. You were scammed. the builder still needs to be paid. Having been sent changed bank details you should have been suspicious and checked with the builder.

[Bigends]

Happens regularly - had a local public school ripped off for over £200k - received an email purporting to be from the builders they were using changing account details -asking that all monies owed were transferred into that new account

[Jerry Can]

herewego said:

This has been done before. Hopefully you spotted the scam and stopped it in time, sounds like it in which case no problem. You were sent the scam email and responded. You were scammed. the builder still needs to be paid. Having been sent changed bank details you should have been suspicious and checked with the builder.

I did check, he said he'd had a few issues with emails going missing. I agree with the earlier poster, hotmail and security not up to scratch, some liability on his part surely?

[Bigyoke]

Jerry Can said:

I did check, he said he'd had a few issues with emails going missing. I agree with the earlier poster, hotmail and security not up to scratch, some liability on his part surely?

Nope. If you car was nicked now would you feel if the insurance co. wouldn't pay up because you only had the standard, factory fitted security and not something better? IT security, at least around email, is a low priority for many businesses, even some you'd think would be more concerned about it, let alone a business whose primary concern is building things.

If you've notified the banks in time & they managed to freeze the account you should be able to recover some, if not all of the money.

Always, always, always confirm any changes in payments details by speaking to the company and confirming the change.

[bitchstewie]

I don't think the liability would be any different than if someone had simply typed out a Word document to look like his invoice and posted it to you.

I know it's easy to play the Monday morning quarterback but over a large sum of money I'd like to think I'd have checked especially coming from a Hotmail account.

Fingers crossed your bank plays nice.

[Gareth79]

Innowaybored said:

No idea on the legalities but I amazed that some businesses would still use hotmail/yahoo etc for business related email addresses and service.

Are these people idiots? Clearly they aren't very professional. In general small businesses security is woeful. I wouldn't trust 90% of small businesses to hold or process my data securely.

It is unprofessional in general, but to be honest the security of a hotmail account isn't any worse than any others, and often it's better because with many providers you can set up 2-factor authentication, have alerts about suspicious logins etc (although clearly they didn't do that here).

[motco]

So for the ignorant here, and I count myself as one such, if not Yahoo/Hotmail then what? Thanks - this is a serious question from a private payer of bills, not a business payee.

Does it help to use an email client such as Windows Live Mail or Outlook Express and set it to delete emails from the server when opened?

[bitchstewie]

motco said:

So for the ignorant here, and I count myself as one such, if not Yahoo/Hotmail then what? Thanks - this is a serious question from a private payer of bills, not a business payee.

Does it help to use an email client such as Windows Live Mail or Outlook Express and set it to delete emails from the server when opened?

As someone receiving emails it comes down to basic vigilance and "spidey sense" quite honestly.

You can help protect your own account by using services which offer 2 factor authentication, personally I use Gmail and I use their webmail because it tells me stuff that I might miss if I were simply looking at emails in Outlook i.e. Google often already know if an email looks suspicious and their webmail interface will tell you, they often know if an email looks like a phishing email and they tell you, they know if it has certain characteristics that make it look fraudulent and they tell you.

If I were a business then it's pretty simple really, you spend £4/month on something like Google Apps or Office 365, you spend £10/year on a domain name so you present a professional appearance, and you combine the two.

The difficulty is that as with many IT things the builder probably knows how to build a wall so wings it rather than throw a bit of money at someone who knows how to setup a cheap and functional professional email setup.

[C. Grimsley]

I run a business and use a hotmail account and have done for ten years, am I wrong, what's the issues with hotmail?

Carl

[TooMany2cvs]

bhstewie said:

I don't think the liability would be any different than if someone had simply typed out a Word document to look like his invoice and posted it to you.

Yep, that's the key to it.

Just because you receive an email that says it comes from [e-mail], doesn't mean it's actually come from there. It's trivial to forge sender on an email - just as it is to send a letter that says it comes from 10 Downing Street.

[motco]

bhstewie said:

motco said:

So for the ignorant here, and I count myself as one such, if not Yahoo/Hotmail then what? Thanks - this is a serious question from a private payer of bills, not a business payee.

Does it help to use an email client such as Windows Live Mail or Outlook Express and set it to delete emails from the server when opened?

As someone receiving emails it comes down to basic vigilance and "spidey sense" quite honestly.

You can help protect your own account by using services which offer 2 factor authentication, personally I use Gmail and I use their webmail because it tells me stuff that I might miss if I were simply looking at emails in Outlook i.e. Google often already know if an email looks suspicious and their webmail interface will tell you, they often know if an email looks like a phishing email and they tell you, they know if it has certain characteristics that make it look fraudulent and they tell you.

If I were a business then it's pretty simple really, you spend £4/month on something like Google Apps or Office 365, you spend £10/year on a domain name so you present a professional appearance, and you combine the two.

The difficulty is that as with many IT things the builder probably knows how to build a wall so wings it rather than throw a bit of money at someone who knows how to setup a cheap and functional professional email setup.

Thanks bhstewie

[eldar]

C. Grimsley said:

I run a business and use a hotmail account and have done for ten years, am I wrong, what's the issues with hotmail?

Carl

Looks very 20th century for anything other than a tiny, part time business. A tenner a year for a proper domain name is almost a no brainer.

And as the OP has discovered, easy to scam both you and your customers.

[bitchstewie]

C. Grimsley said:

I run a business and use a hotmail account and have done for ten years, am I wrong, what's the issues with hotmail?

Carl

For a start it looks amateurish. Sorry if that sounds harsh but it's the way I see it.

I drive to and from work and I see all manner of vans with expensive logos on them in proper signwriting and it's all undone by having to try to remember that it's "[e-mail]" scrawled on the van rather than "[e-mail]".

If you spend a tenner on a domain name and go buy a 365 or Google Apps subscription you'll present a much better image to your customers and it also gives you access to things that makes it less easy to spoof an email so it looks like it's come from you.

If Hotmail does offer 2 factor authentication go and turn it on now.

[TooMany2cvs]

bhstewie said:

I see all manner of vans with expensive logos on them in proper signwriting and it's all undone by having to try to remember that it's "[e-mail]" scrawled on the van rather than "[e-mail]".

What always makes me grimace is when you see www.kingstonflooring.com right next to [e-mail]

I just want to email the company and ask if they're so lax and amateurish in all of their business practices.

[Durzel]

bhstewie said:

For a start it looks amateurish. Sorry if that sounds harsh but it's the way I see it.

I drive to and from work and I see all manner of vans with expensive logos on them in proper signwriting and it's all undone by having to try to remember that it's "[e-mail]" scrawled on the van rather than "[e-mail]".

If you spend a tenner on a domain name and go buy a 365 or Google Apps subscription you'll present a much better image to your customers and it also gives you access to things that makes it less easy to spoof an email so it looks like it's come from you.

If Hotmail does offer 2 factor authentication go and turn it on now.

+1

Why would a company choose to use something as generic as "hotmail.com", aside from any security risks, as part of their branding?

It costs buttons for a catch-all mailbox at @companyname.com, a tiny fraction of sign-writing or a website design, yet it's not that uncommon? Boggles the mind.

Edited by Durzel on Saturday 26th March 17:55

[Stoofa]

C. Grimsley said:

I run a business and use a hotmail account and have done for ten years, am I wrong, what's the issues with hotmail?

Carl

Any email you were to send to me for example would be flagged as SPAM - as is 90% of any Hotmail email received.
In this day and age - £10 for your own co.uk domain and the ability to have sales@ support@ of your own domain for around that fee every year, why wouldn't you want to look professional?

123reg, Godaddy - they can both set you up for peanuts.

[TurricanII]

This and carefully researched/crafted 'CEO fraud' are rocketing at the moment.

You still owe the builder - even if he had no password on his account.

One rule should help all here: When a change of payment or bank details is requested, a phone call/skype/visit to the person to confirm is critical.

[konark]

Id suspect a scam the moment a builder wanted me to put money in their bank account.

All the ones I know only take cash.