Protect your Organisation from fraud and scams

Cloned websites are a type of phishing scam where cybercriminals create replicas of legitimate websites to trick users into providing sensitive information such as login credentials or financial details. We’ve added some safety tips below:

Check the URL carefully: Look for misspellings, unusual characters or unexpected domains.
Security certificates: Always look for “https” and the padlock icon in the address bar
Poor quality: Look out for grammatical errors, spelling mistakes or an unprofessional design.
Research: Verify the company’s contact information through independent sources
Be wary: If you suspect the website is a clone, do not enter any sensitive information.

This involves scammers requesting upfront payments for goods, services or financial opportunities that never materialise. Common schemes include fake loans, inheritance claims and job opportunities that do not exist. Victims are often pressured to act quickly and provide personal or financial information, so please remain vigilant to unsolicited offers, requests for upfront payments or urgent and threatening language. We would always advise customers to verify the legitimacy of senders before responding, avoid sharing sensitive information with unknown parties and review all of the message content to confirm whether it is a genuine request.

Scammers use clever tricks to make you believe you’re sending money to a trusted person or business. For example, they pretend to be your bank, a seller on an online marketplace, or even a family member in trouble.

If you suspect you’re a victim of authorised push payment fraud, report it to our dedicated fraud number freephone 0808 196 8420 so that we can investigate on your behalf.

Telephone fraud, or ‘vishing’, is becoming increasingly commonplace. It’s when fraudsters don’t scam victims online, but call them instead, aiming to trick them into disclosing information or completing certain actions which would result in financial loss.

If you receive a call from someone claiming to be from Unity Trust Bank and you think it might be a scam, do not disclose your passwords or private bank details. Instead, end the call and report it to our dedicated fraud number, freephone 0808 196 8420 so that we can investigate on your behalf.

Phishing emails are unsolicited emails which appear to be from a genuine source, encouraging you to disclose confidential, personal or financial information.

Phishing emails may contain:

• A request for confidential or secure information (such as your Online Banking log in, passwords, account numbers or PIN numbers).
• Instructions to complete an attached document, or reply to the email, or to click through to a website to verify your account. Don’t open attachments or click on links if you suspect they may not be genuine.
• Warnings of a sudden change in an account which requires you to verify that you still use the service.
• Poor spelling and grammar.

Unity Trust Bank will never send you an email asking you to reconfirm your security details and we will never ask you to divulge your full passwords via email. If you receive an email appearing to be from Unity Trust Bank that looks suspicious, forward it to fraud@unity.co.uk, block the sender, delete the original email, and empty your deleted items. Or you can call our dedicated fraud number, freephone 0808 196 8420.

Smishing is when fraudsters send text messages mimicking companies such as banks, convincing you to click a link which could download viruses onto your device or direct you to a fake website to trick you into releasing personal and financial information. Unity only provides a text service for authenticating accounts or payment requests; any other text messages received that appear to be from Unity are likely to be fraudulent.

If you think that you’ve been a victim of a smishing attack, do not reply to it; instead block the number and delete the message. You can also call our dedicated fraud number, freephone 0808 196 8420. By doing so you’ll also help to protect many more people from being affected.

Invoice or Push Payment fraud is commonplace across the banking industry and happens when a fraudster sends an invoice or instruction requesting a payment. They may intercept emails from legitimate organisations and alter the account details on the invoice, which may lead to money being re-directed into another account.

Organisations are also seeing an increase in fraudsters impersonating staff to redirect salary payments. The fraudster creates an email address that is a close match to the employee’s correct address and sends a request to change their bank details ahead of the next payment date.

Here’s what you can do:

• Call for verification: If account details have changed or the payment is to an unknown beneficiary, call the organisation on a recognised number and ask them to verbally confirm the account details. Do not use the phone number on the email as this could be the fraudster’s number.
• Improve internal procedures: Where appropriate, assign at least two people to double-check payments being made or approved.
• Secure IT infrastructure: Ensure computers and IT systems are protected with software to prevent your organisation from being hacked and make sure you use the latest version of your internet browser with all updates installed.
• Contact us: If something doesn’t seem right, call our dedicated fraud number, freephone 0808 196 8420.

Cheques can be manipulated into a fraudulent payment, whether it is a counterfeit cheque (a cheque created by a fraudster) or by alteration (written cheque modified by a fraudster) or a forged signature on a genuine cheque.

Here’s what you can do:

• Don’t pre-sign cheques.
• Use black ballpoint pen.
• Make sure you draw a line after you have written the payee name, amount in words and amount.
• Don’t leave any gaps before or after the numbers in the amount box to minimise the risk of a fraudster altering the cheque.
• Keep your cheque book in a locked location and restrict access to essential staff only.
• Periodically check that individual cheques have not been removed from the middle of the cheque book or from the computer cheque stock.

BEC is where a criminal attempts to trick an employee into transferring funds or revealing sensitive information. They often impersonate a senior employee. The criminals behind BEC send convincing-looking emails that might request unusual payments or contain links to fake websites. Some emails may contain viruses disguised as harmless attachments which are activated when opened.

Here’s what you can do:

• Think about your usual working practices around financial transactions. If you get an email from an organisation you do not do business with, treat it with caution.
• Look out for emails that appear to come from a high-ranking person within your organisation, requesting a payment to a particular account. Look at the sender’s name and email address. Does it look legitimate or is it trying to mimic someone you know?
• Ensure that all important email requests are verified using another method such as text message, a phone call or in-person.
• Does the email suggest you need to take action urgently? Be suspicious of words like ‘send these details within 24 hours’.

Social engineering is when criminals try to scam you using impersonation. Fraudsters attempt to gain your trust and  trick you into voluntarily disclosing confidential information. They often lie to construct a realistic situation to either scare you or excite you. In either case, they hope you’ll hand over your personal information and/or money.

Commonly used methods are fake phone calls, emails, web pages and messages. Scammers might impersonate officials from trusted organisations such as banks, telecommunications companies and government agencies. They do it with the intent of convincing you to give them your sensitive personal information like account passwords.

This is when fraudsters use your identity for their own financial gain. Often these crimes remain undetected for some time, you may not even realise your information’s been stolen until a bill or welcome letter arrives for something you didn’t buy or sign up for.

Here’s what you can do:

• Be extremely wary of unsolicited phone calls, letters or emails from your bank or other financial institution asking you to confirm your personal details.
• If you think someone is misusing your bank account details, report it to your bank immediately.