Small Business Narrowly Escapes €20,000 Bank Spoofing Scam: what residents need to know

The Anatomy of a High-Stakes Bank Spoof

The near-theft began when a company accountant attempted to access her SEB bank account via a web browser. Rather than typing the address directly, she used a search engine and clicked on a result that appeared legitimate. The site was a pixel-perfect clone of the official portal, though the URL was slightly altered.

Upon attempting to log in, the accountant was met with repeated ‘connection failed’ messages. These delays were a tactical ruse; while she saw a loading icon, the scammers were using her captured credentials in real-time to initiate two separate transfers of €10,000 each. Believing she was merely re-attempting a login, the accountant authorized the requests using her mobile security tool. It was only after the second ‘failed’ attempt that she realized she had actually signed two distinct payment orders.

Fortunately, the accountant contacted the bank immediately. Because the funds had been transferred to another account within the same bank—which had also been compromised—SEB’s prevention systems were able to freeze the transactions and return the full amount to the company.

The Growing Role of AI in Financial Fraud

Daiva Uosytė, Head of the Prevention Department at SEB Bank, warns that this case is part of a broader trend where criminals use artificial intelligence to create highly convincing replicas of institutional websites. These AI tools allow scammers to mirror the original content, branding, and user interface of a bank within minutes, making it nearly impossible for a distracted user to spot the difference at a glance.

“Scammers are increasingly targeting larger financial resources, moving away from individual residents toward business organizations and their employees,” Uosytė noted. She emphasized that the use of ‘SEO poisoning’—where fake sites are pushed to the top of search engine results—is becoming a primary gateway for these attacks.

Strengthening Internal Business Controls

The incident has also highlighted a common security flaw in SME operations: the concentration of financial power in a single set of hands. In many small firms, a single employee or the director holds the sole authority to both initiate and approve payments.

Financial security experts recommend the ‘four-eyes’ principle, or a 50/50 approval system. Under this protocol, a payment must be initiated by one employee and verified by a second. This secondary check provides a crucial window for an objective observer to notice discrepancies, such as an unusual recipient or a suspicious payment prompt, before the funds leave the account.

Immediate Steps for Financial Protection

To mitigate the risk of falling victim to similar schemes, businesses are advised to implement several practical safeguards:

Direct Access: Always type the bank’s URL directly into the browser or use a verified bookmark. Never click on banking links provided in search results or SMS messages.
Scrutinize the URL: Check for subtle misspellings or unusual domain extensions that differ from the bank’s official address.
Monitor Security Prompts: Pay close attention to the text on mobile authentication apps (like Smart-ID or physical tokens). If the app asks to ‘Sign a Payment’ when you are only trying to ‘Log In,’ terminate the session immediately.
The ‘Spinning’ Red Flag: If a banking site appears to hang or asks for repeated logins, it is often a sign that a scammer is manually processing your data in the background.
Rapid Reporting: In the event of a suspected breach, every second counts. Contacting the bank within the first few minutes is often the only way to successfully intercept a fraudulent transfer.

Source: ELTA