New Dangerous Variation of the Nigerian Scam

involving checks

[Rugles]

Long story short. Our company had a legit check to a supplier stolen out of the mail.

The people who stole it took all the information off the check and reproduced new high quality fake checks using the banking information on our real check (or cheque as I normally write it ;-) ).

A month ago, somebody in the Bronx tried to cash one of these fake checks for 30 grand. Our bank stopped it after it was deposited. So we are not out any money. We closed the account shortly after.

Today, another one of these fake checks for 90 grand shows up in Florida. The person who received the check contacted us. Turns out he was doing the reverse Nigerian on the scammers.

It started when he replied to an email from them. They offered to give him 10% for acting as a go between for our company and some bogus agricultural company in Europe and Africa. They provided him all these bogus documents detailing our "contract" between the two companies.

They offer him 10% of any checks he can cash. They gave a place to forward to the 90% to in Texas. Obviously this guy in Florida and the other guy in the Bronx will be on the hook when the check bounces.

But, this scam was all by email.

[jwolthuis]

Long story short, someone stole a check of yours in the mail (a felony in the US).

The other part of the story involves a fake check going to a closed account.

Don't pay invoices with physical checks by mail. Every bank has online Bill Pay, usually for free.

[piatkow]

Don't pay invoices with physical checks

But if you use a secure web page the bad guys will immediately grab all your bank details. Far safer to put then all on a paper cheque.

We have all come across people who actually think like that, not helped by some of the security "advice" that gets printed in the popular press.

Cheque based fraud is well established although you don't hear so much about it these days. Probably because anti money laundering regs make it more difficult to open a bank account.

[lammert]

But if you use a secure web page the bad guys will immediately grab all your bank details.

Don't know about the situation in your country, but the banks in all the countries where I have bank accounts--both in Europe and Asia--allow to logon to the secure web portal of the bank and make invoice payments from there directly to the bank account of the beneficiary. Unless there are bad guys working at the IT department of those banks, I don't expect anyone to grab my bank details.

I recently went to the regional head office of my Asian bank with an AdSense check. They asked me "What is that? In which country do they still use them?" They had to call the national office of their bank to ask for the procedure to process it. Checks are so twentieth century...

[jecasc]

I use a chip card based system for all my payments. I have a banking software and a chip card reader connected to my computer. To transfer money I have to put my chipcard into the reader and type in a PIN number.

We don't use cheques and don't receive many cheques. Actually we only received a cheque once and my apprentice did not know what it was punched holes in it and filed it away.

[piatkow]

Unless there are bad guys working at the IT department of those banks, I don't expect anyone to grab my bank details.

I knew I should have used a smiley in my last post. I was referring to popular perception not fact.

On the odd occasions when I need to write a cheque (normally for Christmas and birthday presents) it is usually quite a battle to find where I left the cheque book.

[Rugles]

Don't pay invoices with physical checks by mail.

We have hundreds of suppliers, many want only paper cheques. We pay electronically when we can.

We have changed our practices to help prevent this in the future.

97 years in business, first time it has happened. We are not out one single penny, by the way.

The reason I posted it here, is because the victims were recruited via email and it is a variation of the Nigerian scam where they offer you 10% of whatever ammount.

[bird]

Recruiting for "payment processing services" has been in the spam channels for years. In the US, those "processors" may still be used for cashing fake checks. Elsewhere they are used as recipients for bank transfers from victims where the online banking credentials have been captured by spyware. If successful, the "processor" will usually forward the other 90% via moneygram et al, so that the real recipient can't be tracked.