New Scam Targets Small Businesses Via Email Spoofing

A sophisticated scam is targeting small businesses by impersonating suppliers through email. The attackers send invoices with familiar details and the same amounts, but alter only the bank account number for payment. This tactic exploits ongoing email correspondence between businesses and their regular suppliers, sometimes after months of monitoring the supplier's inbox.

The Israeli Payment Services Law of 2019 provides a framework for recourse. Under Section 24, a payment instrument holder's liability for misuse is limited to 75 shekels plus 30 shekels for each day until notification, capped at 450 shekels if notified within 30 days. Section 27 mandates payment service providers to refund funds within eight business days.

Small businesses fall under these protections, unlike larger corporations with annual revenues exceeding 30 million shekels, who can agree to different terms. The key distinction for legal recourse is who initiated the payment. Unauthorized charges are covered by the refund provisions. However, if a business employee, after reading a fraudulent email, manually enters the payment details, it is considered an authorized payment instruction, and the law does not mandate a refund.

Recourse may still be possible through a negligence claim, arguing the bank should have flagged an unusual transaction. The article emphasizes that verifying bank account changes via a phone call to a number from the contract, not the email, is the only reliable method to prevent this scam before payment. Other preventative measures include separating the roles of updating supplier bank details and approving payments, and requiring a second approval for transactions above a certain threshold.

Separate from payment fraud, businesses are also targets for identity theft, where fraudulent business accounts are opened in their name, potentially leading to significant debt. Prompt action within the first week of discovering such fraud is crucial for resolution, as delays can result in years of dealing with authorities.