Scam hits builders' invoices

Urban Homes owner Daniel Klinkenberg said his company had warned clients to check with them if any emails appeared suspicious or seemed out of the ordinary. Photo / iStock

More than $25,000 stolen in sophisticated hacking operation targeting company emails.

At least three people have lost more than $25,000 in a "highly sophisticated" scam targeting the building industry.

Last week, two Consumer NZ members lost more than $20,000 after their builders' email invoices were hacked, instructing them to redirect payment to the fraudster's bank account.

Now a third victim says she has lost several thousand dollars to the same scam. She and her partner were not aware they had been scammed for a week.

She said the situation was extremely unfair and everyone was ducking for cover.

"The builder says it wasn't their fault that they didn't pay the invoice, the bank says they are not responsible, the insurance company doesn't cover it and the builder's insurer also isn't interested."

Urban Homes owner Daniel Klinkenberg said his company had warned clients to check with them if any emails appeared suspicious or seemed out of the ordinary.

Mr Klinkenberg said his company used robust IT security systems and had not been hit by the scam, but no one was immune to it.

He said wording used in the scam email, which tells homeowners to change account numbers because of internal issues, sounded legitimate.

"It's shocking. The figures for the invoice still stack up. They're emailing people really cleverly and saying 'Hey look your home's coming together, looking great on-site, the roof's gone on,' so it's quite personalised."

Mr Klinkenberg said a system his company uses could not eliminate the scam.

Instead, Urban Homes acknowledged every payment with a reply email and told clients to be wary.

Consumer NZ chief executive Sue Chetwin said the scam was highly sophisticated and there was little to be done once the money had been paid.

"Building projects tend to be costly and if you're on a tight budget it would just be the most awful thing to happen."

She advised homeowners to talk to their builder before making a payment, double-check the amount and account number and save the correct number into their internet banking list of long-term payees.

If the email is explaining a change of account numbers, query it with the builder before making the payment.

Ms Chetwin said there was some onus on banks to warn customers. "Banks have to take some responsibility in making people aware they have to take quite strong precautions when they're doing things this way."

One of the victims lost $14,000 and was awaiting the outcome of ANZ and police investigations. Another Consumer NZ member, who fell victim to a similar scam last year, was given a goodwill payment of $3300, half the amount she lost, by Kiwibank.

Caution urged when paying bills online

Banking Ombudsman Nicola Sladden said email hacking was common and consumers need to take care when making payments online.

"When looking at cases like this, we would consider whether there was anything in the circumstances that should have alerted the bank to make further inquiry."

She said the Banking Ombudsman's guide to common scams warns customers about identity theft and to check details when making payments online.

"If you are emailing somebody about financial matters involving transferring money, check the arrangements with the person using a means of communication other than email. We also recommend people avoid using public Wi-Fi, particularly if they have bank account information in emails, as it isn't secure and the chance of emails being hacked is higher."

Other tips to keep bank accounts safe include:

Don't give out account details unless the business you are dealing with is established and trusted.

Never accept money into your account for subsequent transfer to others.

Never give out your password.

Check your accounts regularly to ensure money is going to the right places.