Hacker News Reader

Comment by dopamean | Hacker News Reader

I have a friend who's father is very, very wealthy. He purchases a lot of art and often actually finalizes the sales by emailing someone who works for him something to the effect of "please transfer X dollars to Y party for Z piece of artwork." A few years ago someone got access to his gmail account in what appeared to be a mass phishing attack and saw several of these emails in his sent email folder. The intruder was able to have a few million dollars successfully transferred to himself. It was several months before it was noticed and the guy was never caught.

My friend's father now uses two factor auth and has whoever receives those emails confirm via phone call the next day.

View on HN

Last week I received a similar e-mail from my co-founder, asking me if I could transfer some money to an account. I found it a little strange, but not enough to question that it actually had to be done. Since I was headed to the office anyway, I waited until I got in, and asked him what the money was for.

"What money? What email?"

Turns out the e-mail was sent from a fake gmail account with the name of my co-founder. Hadn't spotted that the email address was wrong, as it was hidden in my email client.

I reported the email to Google and sent the scammer a sarcastic reply: "how many millions do you need?"

The scammers' response? "You're fired"

What a cheeky fraudster! That said, I'm sure he has pulled it off before.

Are you in the US?

Don't 'know your customer' laws ensure that no bank account is owned by an anon?

Fraudsters frequently use "smurfs", who are often less than sophisticated, to get around this.

Pretend you're a not-too-savvy-about-international-finance person in the US who, because you have a pulse and are at least minimally socially established, has a checking account. The Internets tell you that you can make good money working from home as an accounts payable clerk. On showing up to work on the first day, your new boss tells you that the job is occasionally getting an email with instructions regarding an incoming wire transfer into your bank account, with instructions to keep 10% for yourself (your salary, obviously) and forward 90% to the supplier he tells you. Totally aboveboard, right?

Money laundering is a fascinating, fascinating topic.

> Don't 'know your customer' laws ensure that no bank account is owned by an anon?

Unless your scammer is really, really stupid these accounts are in the names of third party patsies who are promised some cut or percentage of the amount, or have been conned into thinking they're helping someone out (usually the money would then be transferred from that US account to somewhere foreign via western union or the like).

Or in the name of some other person who has no idea the account exists. In the UK you basically need a utility bill and a photocopy of a passport to open an account which is not that hard to fake.

I'm in Denmark. We didn't get that far in the conversation though, but I'm sure the scammer had protective measures - like the ones mentioned by other replies - to prevent being caught easily after a transfer.

This actually happened to a law firm that I know of. One of their clients had their account hacked and in the client's mailbox they found emails from the law firm including some outstanding bills payable to the firm. The attacker then spoofed an email from the law firm to the client along the lines of "our bank details have changed to xxx please transfer your outstanding bill by [date]". The client didn't realise anything was wrong until the law firm chased him for the bill by which time the account the attacker had used was closed and the money moved offshore.

That's pretty funny.

Wow, that's pretty awesome. What a wake up call lmao

Reply on news.ycombinator.com