The Estonian Centre for Defence Investments (RKIK) lost almost €60,000 to fraudsters in 2024. The loss has only become public now, two years later, through reports by Delfi and ERR. It was a classic invoice fraud, and the same scheme works just as well against a small company.
What happened?
According to Delfi and ERR, RKIK fell victim to business email fraud: criminals inserted themselves into an email exchange and sent a fake invoice. The agency filed a criminal complaint, and the police later closed the case without identifying the people behind it.
Magnus-Valdemar Saar, who led RKIK at the time, told ERR that the agency notified investigators and introduced additional invoice-processing procedures afterwards. As far as he recalls, the then defence minister, Hanno Pevkur, was also informed. The current director, Elmar Vaher, said he had learned about the case only a few days earlier.
How does business email compromise work?
Helena Jürgenson, an analyst at the Estonian Information System Authority (RIA), explained the scheme to ERR. Somewhere in an organisation, an email account is taken over. The criminals then follow the correspondence for a long time and, at a suitable moment, swap the real invoice for a fake one.
The fake invoice usually looks identical to the real one. RIA’s guidance notes that it typically differs only in the bank account details. Because the message often comes from a genuine mailbox, either the supplier’s or your own, spam filters let it through and nothing looks out of place.
Jürgenson added that falling for this says a lot about an organisation’s processes and security. In other words, protection does not rest on one alert employee. It rests on how invoices are approved.
Who should be concerned?
Any business that pays supplier invoices by bank transfer. The risk is highest where one person approves payments and nobody checks a change of bank details separately.
The criminals do not need to break into your mailbox. Access to a supplier’s email, where your conversations are visible, is enough. The more regular suppliers and recurring invoices you have, the more opportunities they get.
What should you do?
- Verify every change of bank details through a second channel. Call the contact person named in your contract, or a number from the supplier’s website. Never use the phone number or reply address in the email that announced the new account.
- Write down your invoice approval procedure. Decide who approves invoices and what happens when payment details change. A new account number should never reach a payment run unchecked.
- Brief everyone who approves invoices. RIA recommends training them to recognise invoice fraud. Urgency and “our bank account has changed” are always a reason to stop.
- Protect the mailboxes of managers and finance staff. Turn on multi-factor authentication in Microsoft 365 or Google Workspace. Ask your IT partner to alert you to new forwarding rules in those mailboxes.
- If money has gone to the wrong account, call your bank immediately. RIA says a quick reaction may allow the payment to be recalled. Then report the case to the police and, in Estonia, to CERT-EE (cert@cert.ee).
Does DMARC stop invoice fraud?
Partly. When criminals control a real mailbox, as in the scheme Jürgenson described, the email comes from the correct address and DMARC will not block it. Only checking through a second channel helps there.
A common variant, though, is an email that simply pretends to come from your domain. DMARC tells other companies’ mail servers to reject such messages. Our guide to DMARC explains how it works, and the free email check shows in under a minute whether someone can send spoofed email in your domain’s name.
Sources
- ERR News: Defense agency scammed out of nearly €60,000 in email fraud, case closed
- ERR: RKIK kaotas kaks aastat tagasi petturitele peaaegu 60 000 eurot
- Delfi: RKIK kaotas kelmidele ligi 60 000 eurot, avalikkust sellest ei teavitatud
- RIA: Levivad arvepettused! Kontrolli, enne kui maksad (invoice fraud guidance, in Estonian)
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
