The organisation I work for is being targeted by a scammer who is addressing emails to members of the Finance team in each of our locations claiming to be somebody very senior in the organisation. The first email starts with guff like:
Hi
Can you set up a payment for me quickly etc etc.

The top of the email has the spoofed senior persons name but it is easy to spot that it is not from the correct address so eg dsjkfjk@comcast.cn
Although we havent fallen foul of this one of the finance team responded to the very first one!!! it was quickly spotted however that person gave out a small amount of information (another persons name and email address) then we began receiving more targeted attacks by name etc. Anyway vigilance is the key and staff have been re-educated!!!
It occurred to me however that the scammer has sent his bank account details. What can I do with said bank details to cause him as much pain as possible?

UK bank account?

Pass the details to the police so they can get the account owners details from the bank and go from there.

Yes and just found out quite local to one of our offices.

That is one.
You could also set up a donation to a charity with those details?

or buy a bike from Canyon or something

or buy a bike from Canyon or something

Don’t do that, all that’ll happen is Canyon will ship a load of bikes, the scammer will initiate a chargeback and Canyon will lose the bikes.

And you’ll be arrested for fraud.

I’ve got a Canyon bike. they are my mates 🙂

It occurred to me however that the scammer has sent his bank account details. What can I do with said bank details to cause him as much pain as possible?

The most exciting thing you could do is set up a direct debit / standing order maybe
– the account won’t have any money in it though so its a waste of time.

If you think you can turn the tables…. yes you probably can but its unlikely they’ll turn in your favour. At them moment the scammer knows nothing about you so his scam attempts are a complete stab in the dark. Show them how clever you are….. now they know something about you. You’re giving them the opportunity to focus on you and set a trap that you will fall into.

Yes and just found out quite local to one of our offices.

Probably works for you.

Pass the details to the police so they can get the account owners details from the bank and go from there.

That. The account might be genuine though and just a test but it might stop someone else getting caught.

We got targeted where they got into someone’s email, found a pdf of an payment request from a year ago and modified it to look correct but changed one of the payments to go to their account – the rest were ok. Fortunately an email by itself isn’t enough to trigger a payment, no matter how urgent, but I can see how it might work.

We’ve had these. They change one letter in the domain name and then try and get someone in accounts to make an urgent payment on behalf of the MD.

e.g. if the MDs name is John Smith then we receive emails from john.smith@companysname.com where the real domain/email is just john.smith@companyname.com

Give the scammer’s details to w.ferguson@carltonhuxley.com a group of former Police officers who specialise in making life difficult for fraudsters and scammers. Basically, attack dogs.