Interac e-Transfer is increasingly used to transfer funds, including clients submitting payment to architects. Interac’s weak link is the email systems used to send and receive notifications. Even with Autodeposit enabled, cyber criminals can redirect your funds before you receive them, sending your clients payment to the criminal’s account of choice.
In the article below we offer a cautionary tale and some information on how this is possible.
Early this year Pro-Demnity spoke with an architect seeking advice on the possible termination of a contract for an on-going project due to non-payment of the architect’s invoices. The client claimed to have paid the outstanding invoices using Interac e-Transfer, which had previously been used for this purpose without apparent problems. However, this time the payments did not reach the architect’s account.
The client had contacted its own bank and provided the architect with a screen shot confirming the funds had left the client’s account. However, it also showed that the payment had been directed to another e-mail address unrelated to the architect. Something didn’t add up, and the architect remained out of pocket. Hence the question about terminating the contract.
This unfortunate situation remains unresolved; however, Pro-Demnity’s finance team is sharing the following information as a “heads up” to architects who are using or considering use of Interac e-Transfers in their business dealings.
Finance Team Comments
Mis-directed e-Transfers is an increasingly common type of payment fraud that many businesses in Canada are experiencing. Statistics show that 1 in 5 businesses face payment fraud, and a significant 22% of these cases involve intercepted or misdirected e-Transfers.
Many Interac e-Transfer users understand that use of Autodeposit adds a layer of security for these types of transactions. However, assuming the client made the e-Transfer to the architect’s correct email address, and even though the architect had Autodeposit activated, the funds did not arrive. If this is correct, it suggests that the policyholder’s e-mail account may have already been compromised.
When criminals (aka “bad actors”) gain access to an inbox, they can view the incoming deposit notification, click the link before the intended recipient, and redirect the transfer to their own account. Once a fraudulent acceptance occurs, recovery becomes extremely difficult.
Banks may initiate a claw back, which is an attempt to recover the funds after they’ve been paid out. However, the receiving bank can only return the money if the funds are still in the account, and successful recovery is not guaranteed. It is also unclear whether the claw back request should originate from the client or the sender, so both may need to initiate contact with their respective banks.
To prevent such incidents, it is crucial that the policyholder secures their e-mail account or opens a new one if their account may be compromised. Enabling two-factor authentication is another essential step. Additional measures to prevent fraud include using a dedicated e-mail address exclusively for payment notifications and avoiding clicking various links from this e-mail account.
It is important to remember that even with Autodeposit enabled, interception can still occur if a sender’s e-mail account is compromised and the instructions are altered before sending. Banks send the notification by e-mail, not the money. The actual money moves through the banking system, but the instructions needed to deposit or accept the transfer are sent to the e-mail inbox. If the sender’s e-mail is compromised, a fraudster can change instructions before sending. Thus, Autodeposit reduces risk but does not eliminate it entirely. While the bank moves the money, the e-mail controls who gets it as the e-mail inbox holds the keys to collect the funds.
In a follow-up conversation, the architect advised that efforts to recover the funds are continuing, and although they are reluctantly continuing to provide services on the project, at the architect’s insistence they are now using an Electronic Funds Transfer (ETF) process that does not utilize e-mail links.
Action Items for Architects:
- Pro-Demnity’s Professional Liability Insurance coverage does not include coverage for damages or losses incurred by the architect policyholder arising from a cyber security incident as described in this article. Nor does Pro-Demnity have the ability or expertise to provide advice to architects about cybersecurity related to their financial affairs and business transactions. Cyber insurance products are available in the market, and we encourage every architectural practice to speak to their insurance advisor about arranging appropriate coverage.
- Architects are strongly encouraged to contact their bank or financial institution to review what protections are provided by other types of Electronic Funds Transfer (ETF), and to contact their insurance broker to assess what insurance coverage may be available to cover such losses.
Contact the Risk Services team for assistance and guidance whenever you are facing a challenging situation with a project, clients, other consultants or need to understand if you are facing a claim.
Our Contributor
John Hackett, retired OAA, Executive Advisor John’s primary responsibility is more of a calling: to assist architects with concerning circumstances and risks that arise in their practice. He acts as a keen identifier of and advisor of risk issues that impact the architect’s business. John is in charge of preparing and presenting risk education programs and information for those in and outside of the profession. But what John is probably most known as, is “that voice on the phone” to provide “architect to architect” advice and put you at ease if things start to feel out of alignment. John has 35 years of experience as an architect and Certificate of Practice Principal and is a valued contributor to Pro-Demnity for 23 years.