The NHS Counter Fraud Authority (NHSCFA) has received reports of mandate frauds targeting NHS organisations in relation to unsolicited requests for payment where the sender appears to be a senior member of staff within GP Practices/ NHS Bodies.
Email communications have been made to appear as though they have been sent from the Practice Manager (GP Practices) or Directors / Senior Managers (NHS Bodies).

Reports received suggest a payment to be made the same day for an invoice via an email address which does not appear to be linked to the NHS, however the senior member of staff’s name appears alongside it and email signature. Account details are provided upon response to the original email.

How to spot it:

• Email communications show a sense of urgency created by the sender and for payment to be made the same day.
• The email appears to come from a senior member of staff whose name appears alongside the email i.e. Dr John Smith <doctor.438i4094252[@]gmail.com>
• Multiple bank accounts are used including; Metro Bank, HSBC, Nationwide Building Society, National Westminster Bank, Halifax, Santander, Starling and Lloyds. Fraudsters may also use accounts with other banks.

Recommendations for Employees:

• Be vigilant of emails received requesting payment, with a sense of urgency from a senior member of staff.
• Identify if the email has come from an nhs.net or NHS email account associated with the NHS organisation and, if so, seek confirmation from the alleged sender (via phone or other means) directly before any payment is made. If the email has come from a non-NHS address, treat it as not genuine. If you believe an email is fraudulent, please notify your IT team so that the email address can be blocked and then delete the email.
• If you believe your organisation has received what is believed to be a mandate fraud, please report this to your Anti- Fraud Specialist and your local IT Security Lead.