On 2016-10-07 14:46, Mike Kellenberger wrote: [..]
The second e-mail is forged of course. We haven't beeen able to find out where the original mail gets captured (most likely on the suppliers client, because in one case, more than one customer of the supplier was affected).
What do the headers look like? They should give a clear view of what happened where...
The fraudulent bank account was in UK in both cases, in one case the amount was around CHF 6K, where the UK authorities did not get active, in the second case it was a 6 digit amount... That case is still ongoing.
You might want to go through the banks instead of the authorities in this case; as the banks are the ones who lose.
I can forward stuff to the right parties if you want.
Greets, Jeroen