It all started when I received an email from Sally, one of
our vendors.
She said that due to COVID, they are no longer accepting
paper checks anymore and that we needed to use wire transfer
instead, she said, we owed $900,000.
This is a lot of money, so obviously my first reaction was
to verify this.
I looked it up in our system and it was true we did.
And it's not like it was a brand new email.
It was a response to an email thread we had going on for
months. Even her email address checked out.
But since I've never spoken a Sally, I decided to give her a call.
She told me she is working from home just like everyone else
these days and confirmed that the wire transfer was in fact
the new policy.
I asked her to send me the wire transfer info so I could
set it up in our system and submit payment.
It wasn't until days later that we realized we were scammed,
but how, like, I did everything I was supposed to.
What I didn't know was that Sally's email was hacked and
the scammers copied her entire inbox to a fake domain that
looked almost identical to Sally's real email.
Now because they had the full inbox, they were able to reply
to the email chains, and because I called the number in the
email, the fake Sally answered.
Meanwhile, the real Sally had no clue what was going on because
the conversation continued from the fake inbox.
Since then, I never trust email, and neither should you.
But here's a few tips so you don't do what I did.
Always call the number in your vendor management system to
verify any request to change any info, including phone number,
address and obviously bank info.
Also ask for a bank certification to verify that it matches
the vendor.