A scammer managed to divert the salary of an employee at the North Savo Wellbeing Services County to the wrong bank account through an email scam. The employee’s bank account details were changed based on information provided in the message, and the salary was paid into the account specified by the scammer.
The scam came to light yesterday when the employee noticed that their salary had not arrived. They contacted their employer, which then began investigating the matter.
According to acting Chief Information Officer Marko Ruotsala, the incident resulted from human error by an individual employee. The scam message had been sent from an email address outside the wellbeing services county, but the recipient had not verified its authenticity carefully enough.
The organisation has nearly 13,000 employees and handles a large volume of email. Employees regularly receive various scam messages in which the sender poses as someone else and asks the recipient to act quickly.
Ruotsala says the organisation seeks to prevent scams through mandatory information security and data protection training, regular staff communications and simulated phishing emails.
The employee has since received their salary in the correct account. According to Ruotsala, this was an isolated incident, and no other payments were made to the account specified by the scammer. The wellbeing services county is not aware of any previous similar cases.
A criminal complaint has already been filed over the scam. The wellbeing services county will also report the incident to Finland’s National Cyber Security Centre and the Office of the Data Protection Ombudsman.