Caller ID said it was her banker. Less than three hours later, about $73,000 had left the company's account.
I recently talked with the person who handles the money for a trucking company we know. She's sharp, and this isn't her first day, but scammers are becoming craftier than ever, and it is getting harder to spot by the day.
No matter what your business is, never let your guard down, because this can happen any day of the week.
The call
On a Friday morning, her phone rang showing her bank's number, saved under her personal banker's name. The caller said he was with "the fraud department," gave her a case number, and said someone was trying to send a $12,500 wire out of the account. Had they set it up?
He knew the name of the only signer on the account. He knew their emails and phone numbers. She texted the signer: no, he hadn't sent any wire.
The crook never asked her to send money. He offered to help her stop fraud.
The link
To stop the wire, he sent her a link. It opened an exact copy of her bank's website. She logged in and typed in the code from her security fob. When it asked for the code a second time, he said that was normal. She never read a number out loud. She didn't have to. She typed it into their page, and they used it on the real one.
She even emailed her banker screenshots while still on the phone, to make sure it was legit. Too late. "The minute I gave him that fob, they're in the system."
Then he told her she'd be locked out "for a little bit" while the bank looked for the leak.
What happened while he kept her talking
He was the smooth talker. Somebody else was working inside the real account:
The company's payroll recipients were deleted and replaced with five strangers' bank accounts.
A same-day payroll ACH for about $73,000 was set up, on a day they never run payroll.
The alert email addresses were changed just enough that the "ACH created" alert never reached her.
Her real banker called back: "That's not us." But by the time she got back into the account that afternoon, the payment had already processed. She reversed it, and the bank worked until 5:00 that Friday to claw it back, recovering more than half. The company still lost about $30,800. The rest moved on fast through online banks and payment apps. It's gone.
The timing was no accident, or very good luck for them. Payments had come in the day before, so the account held about $135,000 that morning. When we talked, it held about $25,000.
"I'm not some 80-year-old woman who's like, 'Your grandkids need a ransom.' This was the slickest thing you'd ever see."
What you can take from it
Caller ID proves nothing. Hang up and call back on a number you already have, and talk voice to voice with someone you've dealt with before.
Don't log in through a link someone sends you. Go to the bank's site yourself.
"You'll be locked out for a while" is a red flag. It buys the crooks time while you can't see your own account.
If an alert you always get doesn't show up, find out why.
Have a backup contact at your bank. If her banker had been out that day, who knows if this gets caught in time.
Watch Fridays. Everybody's ready for the weekend, and the crooks count on it.
Protect every computer. The next week, their IT person put security monitoring on every machine on the network, even the ones only used for email.
Report it. Her CPA had her file reports with the FTC and the FBI so there's a record of the theft for taxes.
Final Thoughts
Trucking is the lowest adopter of cyber insurance of anybody we work with. A lot of owners figure they've paid the same people for years and see every check that goes out, so they won't get tricked. But a lot of money moves through a trucking company every day, and these guys are good.
She told me she's now in the same doghouse as the driver who blew a motor the week before. Honestly, just about anybody would have been fooled by this one. $30,000 is nothing to sneeze at, and we've had people lose a lot more than that.
Whether that means looking at cyber coverage or tightening up your own IT and banking protocols, set it up before the phone rings.
PS - Don’t forget about our safety services available to you! Contact us today to chat.
Online Training Courses (TrainingHub)
Employee Handbook & Training Program Review
DOT Violation Review & Appeals
DataQ Assistance for “Not Preventable” Accidents
Plaintiff Playbook Assessment
CAB Report Reviews
Claims Help
Safety Incentives & Driver Award Guidance
Click the logo to go to our homepage!
