Netsafe warns Kiwis over fake invoice scams

Kiwi businesses need to change the culture of cyber security in the workplace, says an expert. Photo / Getty

New Zealanders are being urged to be cautious about online invoices after Netsafe reported an increase in the number of fake invoice scams.

The internet safety group, which helps internet users stay safe online, said the scams usually targeted office administration or accounts functions of a business, and would often attempt to intimidate the user by threatening legal action.

"There has been an increase in email invoice scams asking recipients to make payment on an overdue invoice for a product or service they haven't purchased," Netsafe said.

"New Zealand businesses and individuals have received invoices from companies they have never dealt with stating that payment is overdue and requesting immediate payment. The amounts the scammers are looking for vary, but the requests are all in Australian dollars and they attempt to impersonate real companies."

Netsafe was advising users to be wary opening emails that claimed to be from unknown suppliers, and to not open attached invoices.

The company said changes to usual billing arrangements could also be a red flag.

Online accounting firm Xero is one company that has been used, with consumers being sent fake Xero invoices demanding urgent payment on accounts.

Founder Rod Drury said the company was aware of the scams and had been proactively working to limit this.

"Now we've got to our size, just like every other bit of accounting software out there, we're seeing lots of fraudulent invoices happening and it's really picked up over the last 18 months or so," Drury said.

"We've been doing lots of work around this for a long time including two-factor authentication and working with banks to detect fraudulent accounts and documents."

Netsafe Top Tips
• Be on the lookout for invoices for goods or services that you didn't order or a call from someone claiming to be your regular supplier.

• Always confirm if goods or services have been requested and received before paying an invoice by using a purchase order number system or confirming with employees.

• Limit the number of people in your business who are authorised to make orders or pay invoices.

• If you notice a supplier's usual bank account details have changed, call them to confirm that the invoice is legitimate.

• Make sure you call the supplier using the phone number you have on file, or look it up on their website or in the phone book.

• Don't call the telephone number on the email or invoice, as this will likely be the scammers phone number.

• Immediately cut contact with scammers who attempt to bully or intimidate you.

• If the bank account looks like it's an overseas bank account, or you have any suspicions about the payment details sent to you, investigate further.