This is just as a quick reminder regarding a common VAT fraud which has been around since last year, but which appears to be on the rise again.
The fraud is commonly known as “Change of banking details” and this is where the fraudsters pretend to be real and legitimate suppliers to obtain payments or repayments of VAT meant for others. The fraudsters are getting smarter and smarter each day and therefore it’s important for companies to stay alert and put the right protections in place.
How does the VAT fraud work?
The fraudsters send fake emails or documents to a company or HMRC, claiming to be from a legitimate supplier. They say the supplier’s bank details have changed and ask the company or HMRC to use the new ones for future payments.
The details are then updated in the system and the next payment goes straight into the fraudsters’ pockets. By the time the real supplier realises they haven’t been paid, the fraudsters have vanished with the funds.
In the case of HMRC the data is taken from a form VAT484.
This fraud has also been known to come from inside the company. Fraudsters have been known to hack into an employee’s email and using it to trick colleagues into changing the payment details and this is also happening with the repayment of VAT.
Here are some warning signs to look out for:
- weird spelling or bad grammar in emails about bank details,
- strange phone numbers,
- blurry email signatures.
Even a slightly different email address should raise suspicion. Be very careful with email addresses. Look for additional small letters, which you might otherwise overlook or not notice i.e. www.rpgcc.co.uk v www.rpgccc.co.uk, it is easy to miss!
We also know of a case where a real and legitimate email address was used but the emails were being intercepted, please be extra vigilant.
To protect yourself, always double-check your banking details and check any changes to banking details by calling the supplier direct to re-confirm. Make sure you use a phone number you already have, not one from a suspicious email or even a webpage (these are also created by fraudsters to make the business look legitimate) Remember, don’t make any changes until you’re 100% sure it’s legitimate and valid.
Since writing this post, we have had an update from HMRC. HMRC have confirmed that they are aware of a spate of fraudulent changes to taxpayers’ bank account details. Where they had identified these, they have dealt with them, but had not thought it necessary to let the taxpayer know.
Going forward, it seems that there is a plan from HMRC to withdraw the pdf version of Form VAT484 and that, until they do, they are now asking Large Business ‘customers’ to confirm that any requested changes are genuine. This, of course, assumes that the fraud has been specifically targeted at larger businesses, and that it has relied exclusively on the pdf form.
If, as we have been reading the vast majority of fraud cases involve smaller businesses and HMRC will not necessarily tell them if they identify what might be a fraudulent change of banking details. HMRC have added that they would like to hear about all known instances of the fraud, by reference to the affected VAT registration number. If you believe that your business has been targeted do report this to HMRC so they can take any action they think necessary.
If we all stay one step ahead, we can help prevent VAT fraud and fraud like this happening on a regular basis. If you believe you have been party to a VAT repayment fraud, you should report this to HMRC.
If you would like to speak to a member of RPGCC’s VAT advisory team about any area of VAT or our tax team about any area of personal tax or corporate tax, please contact us on 020 7870 9050.
