Fraud-proofing your organisation: a practical guide for Charities

Common types of fraud

Organisational email compromise occurs when fraudsters gain access to an organisation's email account. Once inside the account, they can access confidential information, gain access to other accounts or even impersonate the charity (often editing invoices or even creating fake invoices to redirect payments made to the organisation to their own account). Fraudsters often use tactics such as phishing to gain access to the account i.e. through the use of scam emails (containing suspicious links or malware), text messages or phone calls to trick their victims into divulging confidential access details.

The so-called CEO Impersonation scam is a social-engineering type attack where a fraudster pretends to be an organisation's leader to convince and trick staff into transferring funds bypassing usual security checks. They create a false sense of urgency that is often made to sound business critical. They also often use a compromised email address or an address that looks very similar to the legitimate address (subtly making changes like replacing "m" with "rn" or using a Cyrillic "o" instead of a Latin "o" which looks identical but isn't). Fraudsters may now even use widely available voice cloning tools to clone a senior person's voice to assist with the fraud. The fraudulent message could be presented as coming from the chair or another member of the board, just as easily as from a member of the staff team - and this may be a more immediate risk for smaller charities.

The risk of insider fraud should not be underestimated. It might be the case that a single person oversees key functions of the organisation with minimal or no supervision (e.g. invoicing and making payments). This creates the opportunity for a fraud to occur because the organisation operates on trust or there are no processes in place to check the activity or their tracks are covered because of the access they have to wider records.

There are others and, of course, fraudsters' methods also continually evolve and adapt over time.

How can charities protect themselves?

• Passwords - use strong passwords, keep them secure and change them regularly.

• Train your staff - ensure everyone in the organisation can identify suspicious activity (particularly phishing and impersonation) and knows who to speak to if they spot something that doesn't look right.

• Identify failure points - consider where the potential weaknesses in your business might be e.g. where only one person has oversight of a key function. Consider ensuring that appropriate authorisation levels are in place or that several trusted staff members have access to the relevant systems/accounts or that access logs are monitored.

• Verify payment details - confirm new bank details using a known, trusted phone number or contact (not using the number provided in the request itself).

• Anti-fraud resources - Use tools and advice available from the likes of CIFAS (such as the National Fraud Database or the Insider Threat Database) and the National Cyber Security Centre to stay up to date on common frauds and threats and measures that you can take to protect the business.

By being aware of common fraud risks, implementing these straight-forward measures and ensuring that trustees, volunteers and paid staff receive the right training, charities can begin to mitigate the risk of their organisations falling victim to fraud. It is important that charities stay on top of this though as new fraud risks emerge and as processes require adapting over time to stay up to date and fit for purpose.

Credit to:

Ben Hay, Legal Director and fraud specialist at VWV

Frankie Williams, Associate and fraud specialist at VWV

Shivaji Shiva, Charities Partner at VWV

If you would like more information about the conversion process please get in touch with our charity law and governance team who can advise and assist you.