Explain what probably happened

[rdjohn]

On Thursday I emailed a number of invoices to people that I know well. All bar one were received and paid correctly.

The invoice was an attachment written in Word with a .jpg of my bank details. One person sent me a text asking why I had changed my bank account. I checked what I had sent and confirmed that the details he had were wrong. He received an email from me saying that he should go ahead as the details are correct.

We then speak and he sends me what he received. The .jpg has been deleted and the new bank details inserted, but apart from that the email and attachment are exactly as I sent. The second email is from my address, but nothing like the wording I used.

I have contacted FraudAware but it’s not much use as no fraud has actually been committed.

My laptop is newish with Win 10, the other guy has recently upgraded his, from Win 7 to 10. He has used Defender to scan for Malware, but nothing is flagged - same as mine.

Can anyone advise how this has been achieved and what sort of spyware is used and where to find it?

I have the name and address and mobile for the fake account holder, but no one seems interested.

Thanks

[bitchstewie]

What sort of email account are you using and how is it secured?

[Narcisus]

Sounds a bit to specific to me. I would say the changes have been made by the recipient.

[rdjohn]

bhstewie said:

What sort of email account are you using and how is it secured?

I use Gmail via Outlook, so has a unique generated password, that even I don’t know

[rdjohn]

Narcisus said:

Sounds a bit to specific to me. I would say the changes have been made by the recipient.

He is both a client and friend - a retired auditor who is not tech savvy.

He flagged the problem

[selym]

Paranoid head on here - could someone have access to your email account, have added a rule to intercept any outgoing emails then adapt them and send on? It doesn't sound difficult.

[bitchstewie]

rdjohn said:

bhstewie said:

What sort of email account are you using and how is it secured?

I use Gmail via Outlook, so has a unique generated password, that even I don’t know

Gmail is good.

I would strongly recommend switching on two factor authentication and using the web interface rather than app passwords.

I'd go to Gmail right now and in the bottom right where it says "Last account activity" click "Details" and see what it shows.

Someone has access to either what you're sending or what the recipient is receiving.

Google tend to do things right and Gmail is very secure if setup with 2FA.

That doesn't rule out things like malware scraping things from your computer or the recipient of your email being compromised and not spotting that the second email may be a spoof etc.

So lots of possibilities.

I would also run a few malware scans of your PC. Presume you're already running antivirus but get a second opinion with something like EMSI or Malware Bytes or some of the other free standalone virus checkers.

[rdjohn]

Perhaps I should have mentioned that he uses AOL.com

I have now resent everything to his BT account, to see what he receives. I am currently in Spain with no one around, while he is in London.

His was one of perhaps 10 similar invoices

I intend finding someone to scan my laptop on Monday.

[oldcynic]

A colleague came across similar a few weeks ago. I think the fraudster had created rules at the account level - he said the helplines were defeated when called but he does it for fun and pocket money so dug deeper.

[bitchstewie]

rdjohn said:

Perhaps I should have mentioned that he uses AOL.com

I have now resent everything to his BT account, to see what he receives. I am currently in Spain with no one around, while he is in London.

I intend finding someone to scan my laptop on Monday.

I'd do what I said and look at the "Details" button and see what's been accessing your account.

It will show you the date and time, the location, and the type of access.

Spoofing emails is very easy but better to be sure.

[rdjohn]

I will check when I return. I do use 2-step authentication.

[megaphone]

Why are you sending word docs and .jpegs? Send as .pdf, they are not as easy to alter and are easier to manage by the recipient, usually smaller files as well.

Also change your Gmail passwords regularly.

[Tycho]

Do you have a second email address? Send the original email to that one and see what comes in. At least you would narrow down where the issue is.

[AJB88]

Either the person has access to yours so has then resent with false details after or the person has access to the other persons, they have then used an email spoofer to resend as if you have sent it.

As said above check your account activity, not sure if your friend can do that on AOL.

[bitchstewie]

This is where I struggle a bit if I'm honest.

The chaps email account could be compromised but it'll keep until he's back home

[AJB88]

BenjiS said:

This is what’s happened: https://www.barclays.co.uk/journal/email-payment-f...

Either your email, his, or both are compromised.

Sounds like its the other persons machine then. OP should check his own account/machine.

[AMST09]

If you google this is well known to happen to lawyers taking deposits for houses

[rdjohn]

megaphone said:

Why are you sending word docs and .jpegs? Send as .pdf, they are not as easy to alter and are easier to manage by the recipient, usually smaller files as well.

Also change your Gmail passwords regularly.

I had worked out that myself. From now on always a .pdf, but I know how I could modify it and keep it looking real with Nitro.

[rdjohn]

Tycho said:

Do you have a second email address? Send the original email to that one and see what comes in. At least you would narrow down where the issue is.

I have done that and they did not arrive.

I am pretty certain it is the other guys that has been mirrored.

[rdjohn]

BenjiS said:

This is what’s happened: https://www.barclays.co.uk/journal/email-payment-f...

Either your email, his, or both are compromised.

That looks like the basis of the problem.

Thank you everyone who has replied. It is greatly appreciated to have this helpful knowledge base to hand.