Salaries meant for staff at a Colombian arts college went to strangers' accounts instead. According to the Spanish outlet El Caso, criminals changed the payroll details at the Tecnológico de Artes Débora Arango and caused losses of about 180,000 euros. Colombian outlet Minuto30 puts the figure at more than 657 million Colombian pesos. The college is in Envigado, in the department of Antioquia, and trains students in arts, design, technology and innovation.
How it was done. Rector Juan Carlos Mejía said the attackers changed the identity document numbers and the bank account details used to pay salaries, El Caso reports. They kept the workers' names on the records so nothing would look out of place. According to Minuto30, the money went to accounts in Bosconia and Valledupar, in the Colombian department of Cesar.
How many staff were hit. El Caso says about ten of the college's 58 employees saw their pay go to unknown accounts. According to El Colombiano, the money was diverted from the payroll run of 15 September.
More than payroll. El Caso also reports two transfers out of the institution's own accounts. Part of that money came from a programme funded by the Inter-American Development Bank. Colombian outlet Minuto30 described the case as unauthorised transactions worth more than 657 million pesos.
Investigation ongoing. According to El Caso, the computers used to make the changes have been seized. The money has been held, and the college is waiting for its claim to be resolved so the funds can be returned. According to Minuto30, the college's IT team found no direct breach of its systems. How the attackers got access has not been explained.
Not an isolated case. El Caso links the case to a recent one in Zaragoza, Spain. There, fraudsters posed as an employee and got his company to change the account his salary was paid into. The fraud only came to light when the man asked his managers why he had not been paid.
Why it matters
No victim contact needed. In this kind of fraud, criminals do not have to trick the worker at all. They target the employer's payroll process, so staff only notice when their salary fails to arrive. A single unchecked change of account details can send a whole payroll to the wrong place.
- Confirm any request to change bank details through a known, separate channel, such as a phone number already on file.
- Require a second person to approve payroll changes to account or ID details.
- Watch for many account changes in a short period, or new accounts that all point to the same region.
- Employees: tell HR straight away if your salary does not arrive.
Sources: El Caso, Minuto30, El Colombiano
Leave a Reply