It started with an article about a scammer altering emails and getting $139,000 in bank transfers when the client went to pay for their car.
Since then, the issue has gotten worse. In 2023 alone “criminals made off with $270,000 from several Mercedes-Benz buyers.” Whilst “across the economy, payment redirection scams were found to have caused losses totalling $224 million in 2022, according to combined data from Scamwatch, the Australian Financial Crimes Exchange, and the government’s ReportCyber system.”
So it’s obvious there are major issues with fraud, scams and payment redirection schemes. With so much money being transferred so fast, it’s no surprise car buyers are being targeted.
At the same time, email is less secure than people think.
There’s many different ways such payment redirection schemes can happen. But a likely way is that people are using the same password for both their email account and other services. When their password is compromised on a different platform, hackers often get a list of thousands or millions of people’s email addresses and passwords. So they login to the people’s email accounts and wait.
When a payment request from a Car Dealership comes in, that’s pay day for the scammer. They will quickly download the attached email, update it with their bank details and alter the email, or delete and resend it.
The car buyers check their email and go to pay for the vehicle. But by then it’s too late. The scammers have already put in their bank account details.
People think they are buying a car. But their savings are going to someone who hacked their email account.
The worst part is that from the Dealership’s perspective, it’s not their fault. But of course that doesn’t stop people from being enraged and taking it to court.
Thankfully, now there’s a solution.
Drivible’s eInvoice system adds just a few more steps and that makes it a lot harder for hackers to cause problems.
Firstly, we don’t send the PDF in the payment request. Instead we send both an SMS and Email. Both contain the basic BSB and Account number details. Enough info that they should both match and the car buyer can see that. They also contain a link to Drivible’s Client site. On there they see the PDF that the Dealership has scanned, the full bank details, car details and settlement amount.
The car buyer should then call the Car Dealership and confirm the details again, to be sure. They can now go to their banking app and make the transfer. Back on the Client site, they can leave a note and let the Dealership know they’ve made the transfer and an email is sent to the Drivible staff, so they know to look out for it.
When the bank transfer has completed, the Dealership can confirm they received it and with a quick click, the client is emailed. Letting them know it all worked fine.
The timely notifications help people know to look out for a transfer and know when it’s been transferred so that if there is any fraud, it’s detected within the time it can be reversed by the bank.
To prevent internal fraud or database alterations we’ve got a 3 way validation process which checks the Bank Details, Deal and eInvoice. If the important fields are changed between any of them, then an alert is raised and the Client can’t view the website.
The system isn’t fool proof. For example they could still try and spoof the website. But it means the hackers have to be much more sophisticated. Also, by using Drivble’s eInvoice system it lets you show regulators, courts, and customers that you took reasonable technical steps to minimise any payment redirection risk.
Unfortunately this is an escalating cat and mouse game. With so much at stake, hackers will get more sophisticated. Which is why Drivible plans on adjusting and changing the steps over time, to keep any potential hackers on their toes. Even more robust security processes and validation steps.
If you want to know more, check the website and request a demo. Drivible has competitive pricing, currently at only $26/user/month which includes an entire Document Storage and Management solution.
It’s easy to use. Just scan and email your Deal Invoices into the system, check the details and send. With that, you could be saving people from losing their life savings.
Want more details? We’ve also got a walkthrough video: