In the salary account fraud scheme, cybercriminals send a brief e-mail in relatively convincing Estonian to the HR manager, requesting that their salary be transferred to a new bank account starting from the following month. A visual fraud is used – a letter is replaced in the name of the employee or a barely noticeable alteration is made in the domain name (ettevõte.ee vs ettveõte.ee). In addition, the insufficient security of the mail account may be exploited to fake the address of an employee, which is difficult for regular people to notice.
According to Tõnu Tammer, Head of CERT-EE, requests of changing the salary account should be required to be signed digitally. ‘This would help to prevent the majority of salary account fraud and prevent causing financial loss to the company. The exploitation of the company’s e-mail address can be prevented with the DMARC solution, which also displays any misuse of the company’s domain.’
Kertu Kärk
Head of the Communication Department at RIA
