Preventing Cyber Crime & Fraud: Invoice Fraud & Man-In-The-Middle attacks

This advice has been collated by East Midlands Special Operations Unit (EMSOU) to raise awareness among businesses and the public.

If you require any further information, assistance or guidance please contact the EMSOU Protect Team EMSOU Protect Team or your local Force protect team.

Invoice Fraud

EMSOU has noted an increase in Invoice Fraud. Essentially, this is when someone requests services from a legitimate organisation and then receives an invoice. Further down the line, the victim then receives further demands for payment. This is because a criminal has either intercepted communications between the victim and the vendor and is attempting to exploit it for personal gain, or because they have assumed that you have – at some point – taken advantage of the vendor’s services.

How to mitigate Invoice Fraud

Easy – we encourage every organisation to print a message like this on the bottom of every invoice sent. The key point, is to encourage customers to use the contact details shown in the initial /original invoice to make contact, otherwise they could be calling the fraudsters!

Man in the Middle Attacks (MiT)

In a Man-In-The-Middle attack is when a malicious individual sits between two communicating parties and intercepts all communications. Usually, the attacker has managed to slip between the sender and recipient before they’ve had a chance to set up any form of encryption – which means anything and everything done online is entirely visible to the attacker.

How does the attack work?

There are multiple ways to create a man in the middle set up.

How to mitigate the risks of MiT attacks

Avoid public Wi-Fi

Especially if you intend to conduct sensitive transactions or correspondence. In fact, it is a good idea to turn your Wi-Fi off altogether when you are out and about to prevent unintended connections. If this is not an option, then consider purchasing a VPN and leaving it turned on. A VPN will encrypt traffic so that even if your connection is compromised, the attacker is unable to decipher what is being sent. Employees that work on the go need to understand the dangers of public Wi-Fi and the importance of securing a connection using a company sanctioned VPN.

Harden your router

Most internet service providers have help pages and even video tutorials demonstrating how to rename your Wi-Fi. This hides the make and model of the hub, which makes it more difficult to attack. You should also change any default usernames and passwords, because these are easily researched by attackers. Finally, it is possible to encrypt all communication between an electronic device and a hub by setting up ‘WPA2 Personal’ for home users and ‘WPA2 Enterprise’ for organisations. Businesses in particular, should be mindful of how far a WiFi signal extends beyond the premise and the importance of conducting a site survey to check signal strength and the presence of an ‘evil twin’ or ‘rogue access points’.

Harden your device

Check if your browser is up-to-date by visiting a reputable site such as whatismybrowser.com. Additionally, always update your device as soon as possible to make sure that it is not vulnerable to attack. Using an antivirus and a firewall product from a reputable company will also go a long way to providing peace of mind – especially as most MiT attacks rely on the installation of malicious software.

Be wary of phishing emails

Unexpected emails requesting you to update your password or any other login credentials should set alarm bells ringing. Instead of clicking a link, always confirm the authenticity of an email by contacting the organisation using alternative methods. Unexpected invoices or requests for payments should also be investigated to reduce the likelihood of fraud.

For organisations, ARP attacks are difficult to protect against. It is possible to map IP addresses directly to MAC addresses manually but this involves significant administrative overhead and is not a practical solution if the organisation is large. In this case, a commercial Arp poisoning detector is probably preferable.

Reporting

Please report all Fraud and Cybercrime to Action Fraud by calling 0300 123 2040 or online.
Forward suspicious emails to report@phishing.gov.uk.
Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).