Business email compromise scams cost at least $22.1m in 2017

The Australian Competition and Consumer Commission’s annual Scamwatch report reveals that Australians lost at least $22.1 million in 2017 through business email compromise (BEC).

BEC involves targeted impersonation, including through credentials obtains via phishing or other means, to convince a target to transfer funds or pay a fraudulent invoice. The ACCC figures include both scams reported to it and to the Australian Cybercrime Online Reporting Network (ACORN).

During 2017, the ACCC received 161,528 reports of scams; a 4 per cent increase compared to the prior year.  The Scamwatch report reveals that in total, the ACCC, ACORN and federal and state agencies received more than 200,000 reports of scams during the 12 months covered by the report — with losses totalling more than $300 million, up $40 million compared to 2016.

Those losses included around $2.1 million related scams involving cryptocurrencies and ICOs.

“With the increased popularity of cryptocurrency speculation in the last quarter of 2017, fake initial coin offerings and other cryptocurrency-related scams were reported to the ACCC,” the report notes.

“It’s very worrying that Australians are losing such extraordinary amounts to scammers,” ACCC deputy chair Delia Rickard said in a statement.

“Based on just the reports provided to the ACCC, victims are losing an average of $6500. In some cases people have lost more than $1 million.

“Some scams are becoming very sophisticated and hard to spot. Scammers use modern technology like social media to contact and deceive their victims. In the past few years, reports indicate scammers are using aggressive techniques both over the phone and online.”

More than 2800 people fell victim to “threat-based impersonation”, the ACCC revealed.

“For example, scammers will impersonate the Australian Taxation Office and threaten people with immediate arrest unless they pay an outstanding tax bill,” Rickard said. “They may pretend to be from Telstra to try to hack into your computer or from Centrelink promising extra payments in return for a ‘fee’.”

The ACCC received 33,000 reports of threat-based impersonation, with more than $4.7 million in reported losses.