A large order comes in from a new customer – a major research university. Excited at the prospect of developing a long-term relationship with such a well known institution, you have no problem shipping out the order right away, with the invoice to follow a couple of days later.
The following week, several orders come in from an established client. Your sales reps have strong relationships with this client, who has always paid on time. Eager to showcase the customer service the client has come to expect from your company, you ship the order as soon as possible, never doubting that the client will pay the bill.
Unfortunately, what may appear to be a profitable order or a promising new customer could instead be an effort to drag your company into a complex scheme the FBI calls “purchase order fraud.”
According to a recent FBI news release, the global scam generally follows these steps:
- Cyber criminals based in Nigeria set up fake websites with domain names almost identical to those of real schools, companies, and institutions. Matching e-mail addresses and spoofed phone numbers (to make a call appear to be coming from the real company and area code) are used to request price quotes from vendors, mostly small businesses, for a variety of products including electronic equipment, hard drives, and pharmaceuticals. The perpetrators do online research to obtain employees’ names and other information to make the requests appear legitimate. The companies or schools being impersonated are typically large or well known, or are existing clients of the business being targeted.
- The criminals then place orders, requesting that shipments be made on credit (typically 30 days). Because the vendor believes the order is coming from an established client or well known institution – some of which even provide credit references – the vendor agrees.
- A U.S. shipping address is provided, which is typically a warehouse, storage facility, or even the residence of a work-from-home or online romance scam victim. From there, the orders are shipped to Nigeria. The FBI refers to these home Internet users as “unsuspecting accomplices” in the complicated scam.
- By the time the packages reach Nigeria, the vendor has billed the real institution and the fraud has been discovered – but the goods are long gone.
As highlighted in a recent Newsday article, many Long Island businesses have been the target of purchase order fraud. In October, Bohemia-based Chromate Industrial Corporation – a distributor of maintenance, repair, and operations supplies – received two orders from the University of Michigan for fluke meters, which measure voltage. The orders, totaling $40,000, were shipped to three separate locations as requested in the purchase order. After the packages were shipped, Chromate invoiced the University of Michigan. The university did not recognize the orders, and after reviewing the purchase orders, determined they were fraudulent. Eventually, with information provided by the FBI, one of the Chromate shipments was intercepted in the United Kingdom before being shipped to Nigeria and was returned to Long Island. However, $30,000 worth of goods never made it back.
Donna Galan, Vice President of Operations at Chromate, described the situation as “very disturbing, especially since we don’t know what the products are ultimately being used for.” But the experience has turned customer service into amateur FBI investigators; Chromate still receives frequent fraudulent orders, but employees now know what to look for. The FBI has published the following indications of fraud:
- Incorrect domain names. In Chromate’s case, the University of Michigan e-mail addresses ended in .com, not .edu.
- The shipping address on a purchase order is different from the business location, or is a residence or storage facility.
- Poorly written correspondence with grammatical errors and misspellings. Phone numbers not associated with the business or institution or are not answered by a live person.
- Orders for large quantities of merchandise, with a request for priority shipment and delayed billing.
The FBI has urged the business community to report any fraud to the FBI or local authorities as soon as the fraud is discovered, as the chance of recovering the shipments drops dramatically once the packages leave the country.
Ms. Galan wants local small businesses to learn from Chromate’s experience. “There were a number of things, looking back, on the e-mails that we could have picked up on,” she says. Now that Chromate’s employees are savvy to the scam, however, the scam is one step closer to being put out of business.
