Companies could avoid payment diversion fraud, an increasingly  common cyber-attack, using a guide being developed at Western’s School of Social Sciences.��

Last year, Australian businesses reported more than $14 million in losses to payment diversion fraud via the Australia Competition and Consumer Commission’s Scamwatch; between January and March 2021, the average losses were more than five times higher than the same period last year.�� 

A team led by Alana Maurushat has spent the last two years identifying the most frequent features of payment diversion fraud via anonymous surveys with affected companies. This is now being further explored through a quantitative study in which they hope to canvass more than 100 victims.��

“A typical target could be a supermarket, and the regular payments it makes to a supplier,” explains Maurushat. “The supermarket will receive an email with features, such as previous correspondence, and a request for payment to an updated bank account.” 

The amount requested will usually correspond with previous payments, Maurushat says — which suggests surveillance of a victim’s computer system via malware for six months or more. “Today’s scammers seem to be able to understand when payments are made, to whom payments are made, and the company’s payments processes.” 

Ken Gamble, head of Sydney-based international cybercrime investigation company IFW Global, where Maurushat acts as an advisor, is sometimes called upon to help recover assets, as authorities are hampered by jurisdictional barriers.��

Gamble says that it’s important stakeholders are aware of evolving patterns in cybercrime. “Alana’s research has been presented to law enforcement, regulators, corporates and the banking industry,” he points out. Payment diversion fraud is mostly handled by state authorities, adds Maurushat, but due to the global nature of the crime, she believes it would be better dealt with by the Australian Federal Police.

The guide, due to be released next year by Western, will include suggested protections such as verifying changes in bank details with suppliers. Maurushat says training staff to spot phishing emails and calls also helps reduce risk. In the future, Maurushat sees the use of multi-factor authentication, as well as advanced quantum encryption, as vital safeguards.��But there’s little room for complacency. Her team has already come across one example of AI mimicking a person’s voice. Maurushat’s
research also found that victims who changed their payment processes, invariably believe they are no longer vulnerable. “Cybercriminals are quicker to adapt than companies are to defend,” she says. “Being secure on email has not stopped companies being attacked again via text messages or calls.”