Interception Fraud

Overview

Interception Fraud is a sophisticated attack where a criminal intercepts a legitimate transaction, often between a business and its supplier, to divert funds into an account they control. This type of fraud typically exploits vulnerabilities in communication channels, most commonly business email, to alter payment details just before a transaction is completed. By inserting themselves into an existing conversation, fraudsters exploit the trust between two parties, making this a particularly deceptive and damaging form of financial crime.

How It Works

Interception Fraud unfolds through a calculated, multi-step process:

1. Reconnaissance & Infiltration: The fraudster first gains unauthorized access to a business's email account, usually through phishing, malware, or credential stuffing attacks. This is a form of Account Takeover (ATO).
2. Silent Monitoring: Once inside, the criminal passively monitors email traffic, searching for patterns related to invoices, payment schedules, and financial communications. They identify key personnel involved in accounts payable and identify upcoming transactions.
3. The Intercept: When a legitimate invoice is sent or a payment is due, the fraudster strikes. They may use the compromised account to send an email altering the payment details on the invoice, or they might create a look-alike domain to fool the recipient. They will often create email forwarding rules to intercept the real supplier's emails, preventing them from discovering the fraud.
4. Fund Diversion: The targeted company, believing the new payment instructions are legitimate, sends the funds to the fraudster's bank account. By the time the real supplier follows up on the missing payment, the criminal has typically withdrawn the funds and vanished.

Why It Matters for Fraud Prevention

For businesses, Interception Fraud poses a multi-faceted threat that goes beyond a single financial loss. The consequences can be severe:

• Significant Financial Loss: The diverted payments are often large B2B transactions, and recovery is extremely difficult.
• Vendor Relationship Damage: The legitimate vendor is left unpaid, leading to disputes, broken trust, and potential legal action that can disrupt a critical supply chain.
• Reputational Harm: An incident suggests weak internal security controls, which can damage a company's reputation with partners, customers, and stakeholders.

Preventing this requires a proactive, layered security posture. It highlights the critical need for solutions that can detect the initial Account Takeover, which is the gateway to this fraud. Monitoring for anomalous login behavior, unusual IP addresses, or the creation of suspicious email forwarding rules can provide early warnings.

Conclusion

Interception Fraud is a stark reminder that payment security is intrinsically linked to communication security. It bypasses many traditional financial controls by targeting the human element and exploiting trusted relationships. To combat this threat, businesses must implement rigorous verification protocols for any change in payment details, such as out-of-band confirmation via a phone call to a known contact. Crucially, this must be paired with robust employee training on phishing awareness and advanced fraud detection solutions that can identify the precursor signs of an account takeover before funds are lost.