Hackers hijack HMRC Covid-19 Job Retention Scheme

Cyber security chiefs issue warning to UK companies as hackers create sophistacted phishing email, disguised as official correspondence from HMRC's Cornavirus Job Retention Scheme

by Patrick Sullivan, Political Editor on 20 April 2020 16:07


Cyber criminals have hijacked HMRC’s Covid-19 Job Retention Scheme, creating a sophisticated scam email designed to trick SMEs into handing over bank account details. The fraud was uncovered by the London-based Lanop Accountancy Group. The email uses official HMRC branding and purports to be from “Jim Harra, First Permanent Secretary and Chief Executive of HMRC”.

Around 50 business owners have so far reported receiving the suspicious emails to Lanop after noticing the email was sent via the address no-reply@ncryptedprojects.com, despite its user title being ‘HM Revenue & Customs’. The email asks for the bank account details of the recipient and includes the following message with typos. “Dear customer, We wrote to you last week to help you prepare to make a claim through the Coronavirus Job Retention Scheme. We are now writing to tell you how to access the Covid-19 relief. You will need to tell your us which UK bank account you want the grant to be paid into, in order to ensure funds are paid as quickly as possible to you.”

Tax guru Aurangzaib Chawla FCCA, Managing Partner, Lanop Accountants told The Commentator, “We're calling upon all businesses to think twice before handing over bank details and making bank transfers in response to email requests during this crisis. Cyber crime is rising rapidly and this is the first of what we expect to be many scam emails, designed to trick unsuspecting owners into handing over private company data. We are also offering free advice about how to tackle these scams and reporting any suspicious activity direct to HMRC.”

Recent analysis from cyber security company Barracuda Networks has suggested that Coronavirus-related phishing emails have risen by 667 per cent since the start of March.

The scams included fraudulent communication purporting to be from the World Health Organisation (WHO) and the NHS and private health suppliers selling facemasks and other personal protection equipment (PPE).

Chris Ross, SVP of Barracuda Networks warned, “It is absolutely vital that businesses have the cyber security systems in place to identify and quarantine phishing emails and ensure that every employee is properly trained to spot suspicious communication and think twice before giving out personal information.”

Entrepreneur Tim Sadler, CEO of Tessian said, “Business owners must be increasingly vigilant during this difficult time, because opportunistic cybercriminals do not miss a trick when it comes to capitalising off the general public’s honesty, naivety or fear. He continued, “Remote workers and business owners, therefore, must proactively consider the legitimacy of any email sent through to them which asks for personal information, admin credentials, or financial details. Always check the display name and email address match up and hover over URLs to make sure they are legitimate before complying with any urgent requests.”

Cyber security expert Andy Harcup, VP EMEA Sales for Absolute Software, warned “The influx of remote workers has inevitably contributed to the increasingly sophisticated phishing attempts, which we have seen grow in frequency since the Covid-19 outbreak.

Harcup continued, “What’s more, organisations still in operation during this pandemic have invested, purchased and borrowed thousands of new devices to manage the shift to remote working. Often, these new devices are not supported by company IT infrastructure or cyber security software. Thus cyber breaches are not only increasing in sophistication and quantity, but they’re also becoming more successful, as employees no longer have the cyber security software or infrastructure in place to flag or block suspected spam, malware of phishing attempts.

“Business owners must introduce these measures as a matter of priority – Covid-19 has been enough for us to worry about without the threat of a breach of personal, professional or client information looming over us.”

blog comments powered by Disqus