Recovered £189,000 - Business Email Compromise (BEC)
Employee was tricked by a sophisticated email spoofing attack, transferring company funds to a fraudulent supplier account.
“As a small business owner, losing £210,000 was existential - we were days from being unable to make payroll. Patterdale's speed was extraordinary; they had a court order within hours and recovered 90% of our funds. They literally saved our company and the livelihoods of 35 employees.”
How they were scammed
A finance manager at Tech Solutions received what appeared to be an email from their regular supplier, informing them of a change in bank account details. The email perfectly matched the supplier's writing style, included the correct invoice reference numbers, and came from an email address that differed by only one character from the legitimate domain. The manager transferred £210,000 to the new account for three outstanding invoices.
When they contacted us
Tech Solutions contacted us immediately - within 4 hours of discovering the fraud when the real supplier called asking about overdue payment.
Our investigation
James Okonkwo led a rapid-response investigation. We identified that the fraudulent email came from a domain registered just 3 days before the transfer, using a privacy-protected registration. The receiving bank account was opened at a UK high-street bank under a shell company. Our digital forensics team identified that the scammer had been monitoring the supplier's email communications for at least 2 weeks before executing the attack.
Challenges faced
Speed was critical - BEC fraud funds are typically moved within hours. The challenge was getting the receiving bank to freeze funds on a Friday afternoon, requiring urgent legal intervention.
Breakthrough moment
Our legal team secured an emergency freezing injunction from the High Court within 6 hours of engagement. This was served on the receiving bank before close of business, preventing the funds from being dispersed over the weekend.
Successful recovery
The freezing injunction secured £195,000 of the £210,000 (the remaining £15,000 had already been transferred to a second-tier account). Through subsequent disclosure orders, we traced the £15,000 to a money service business and recovered £9,000. A criminal investigation led by the police resulted in the arrest of the UK-based account holder. Total recovery: £189,000 (90%), with the remaining £21,000 subject to ongoing criminal proceedings.
Lessons learned
- Always verify bank detail changes through a separate communication channel (phone call to known number)
- Single-character domain variations are a common BEC technique
- Speed of response is critical in BEC cases - funds can be gone within hours
- Companies should implement multi-person approval for large payments
Prevention tips
- Implement a verification procedure for any bank detail changes - always call the supplier on a known number
- Use email authentication protocols (DMARC, SPF, DKIM) to detect spoofed emails
- Require dual authorisation for payments above a certain threshold
- Train finance staff to recognise BEC indicators - urgency, secrecy, unusual payment requests
Related cases
Advance Fee Fraud - Lottery Scam
Retired teacher was convinced she had won an international lottery and paid escalating "processing fees" over 6 months.
Online Marketplace Fraud - Luxury Goods
Client purchased luxury watches from a sophisticated fake marketplace that cloned a legitimate dealer's website.