{"id":7057283,"date":"2026-09-05T06:22:58","date_gmt":"2026-09-05T06:22:58","guid":{"rendered":"https:\/\/som2nypost.com\/accounting\/how-not-to-fall-for-a-cyber-attack-3\/"},"modified":"2026-09-05T06:22:58","modified_gmt":"2026-09-05T06:22:58","slug":"how-not-to-fall-for-a-cyber-attack-3","status":"publish","type":"post","link":"https:\/\/som2nypost.com\/?p=7057283","title":{"rendered":"How Not To Fall For A Cyber Attack"},"content":{"rendered":"


\n<\/p>\n

\n

What is APP Fraud?<\/strong><\/p>\n

Cyber-crime continues to evolve, becoming more sophisticated and harder to detect. One of the most damaging forms is Authorised Push Payment (APP) fraud, where individuals or businesses are tricked into sending money to criminals posing as legitimate contacts.<\/p>\n

The Reality of APP Fraud<\/strong><\/p>\n

APP fraud remains a growing threat. Thousands of cases are reported annually, with losses reaching hundreds of millions of pounds. Small businesses are especially vulnerable due to limited internal controls and over-reliance on email communications. Unlike other types of fraud, APP fraud places the burden of responsibility on the payer, making prevention absolutely critical.<\/p>\n

Honestly \u2013 It Happened to Us<\/strong><\/p>\n

At Pillow May, we experienced APP fraud first-hand. While on holiday with her family, Jessica received a call that changed everything. One of our team members had discovered fraudulent payments authorised on behalf of a client. The root cause was a compromised client email system, but the breach succeeded due to weaknesses in our own internal processes.
Although our client was eventually reimbursed, the emotional and reputational impact was profound. We knew we had to respond not just with fixes, but with a cultural shift.<\/p>\n

What We Learnt \u2013 And What You Can Do<\/strong><\/p>\n

Strengthen Your Insurance and Security<\/strong>
We now hold cyber liability insurance that specifically covers fraudulent payments. Our insurer required us to implement key security measures, including:
\u2022 Password changes every 90 days
\u2022 Multi-factor authentication across all systems
\u2022 Regular penetration testing and system audits
\u2022 Compliance with Cyber Essentials standards to ensure baseline security across devices, software, and networks
Educate and Empower Your Team<\/strong>
Cyber awareness must be embedded in your company culture. We held a training session with our bookkeeping team to dissect what went wrong and how to prevent it. Key takeaways included:
\u2022 Always verify unusual transactions
\u2022 Avoid relying solely on email for payment instructions
\u2022 Understand your clients\u2019 typical payment behaviours
\u2022 Use secure communication platforms for sensitive financial discussions<\/p>\n

Don\u2019t Be Afraid to Question<\/strong>
Encourage your team to challenge anything that feels \u201coff\u201d. Whether it\u2019s a new supplier, a changed bank account, or an unusually large invoice\u2014pick up the phone and verify using known contact details. Fraudsters often use subtle errors in emails or invoices, so vigilance matters.<\/p>\n

Review Your Internal Systems<\/strong>
We introduced:<\/p>\n