VULNpocalypse
LowBreach / campaignMonitoring

Highland Council phishing fraud diverted over £3000, Inverness Courier reports

The Inverness Courier reports a phishing email diverted £3321.41 of Highland Council pay; verify bank detail changes against records you already hold.

Published
Exploitation
No software flaw reported; the Inverness Courier describes social engineering of a payroll bank detail change process

What happened

The Inverness Courier reports that a fraudster impersonated a Highland Council employee and had £3321.41 redirected to their own bank account. The outlet says this comes from a report for the council’s audit committee. The council’s Audit Committee meeting page lists a meeting on 11 November 2026 with internal audit reports on the agenda. The agenda text does not name this incident, so it is not confirmed which report covers it. This advisory has not reviewed the underlying audit report directly.

According to the Inverness Courier, the audit report describes these events:

  • On September 1, 2025, 12 schools across Highland received phishing emails. The emails impersonated employees and asked for bank detail changes.
  • A council business support officer spotted one email and asked the sender to use MyView, the council’s secure employee services system. The sender said they could not access MyView and was given a payroll department email address.
  • When the request reached that address, payroll again told the sender to use MyView. The sender’s email address was not checked against payroll records.
  • The sender claimed technical difficulties, asked for a manual change, and sent several requests for urgency in quick succession. The report identifies this as a “red flag”.
  • Payroll issued a bank mandate form. The returned form had anomalies that were not identified: the address given did not match council records, and the address given for the named bank did not match the bank’s actual address.
  • Payroll also emailed two payslips to the fraudster. The outlet says this disclosed personal and financial information and the incident was considered a data breach.
  • The fraud was only detected on September 26, when the affected employee told payroll they had not been paid.

The outlet says the victim and the council reported the fraud to Police Scotland, which made enquiries and closed the case on February 10, 2026, recording it as an “undetected crime”.

The Courier says the council’s report identified several weaknesses, including the failure to notice tell-tale signs of fraud and the lack of a written process to handle bank detail changes.

A council spokesperson, quoted by the Inverness Courier, said immediate action was taken to review procedures and implement additional safeguards, and called it “an isolated incident”. The spokesperson said the audit report contains an agreed action plan that includes:

  • strengthening verification processes for bank account changes
  • introducing additional checks and oversight
  • enhancing monitoring arrangements

The spokesperson also said the council has put in place further measures to improve staff awareness of phishing and fraud risks, and is working with its payroll software provider on additional system-based controls.

The following are not confirmed:

  • whether other schools or staff were affected beyond this one case
  • whether any of the money was recovered
  • the name of the payroll software provider
  • which of the agreed actions have been completed

Am I affected?

The source only reports harm to one Highland Council employee and to the council. No software vulnerability, product or vendor flaw is reported. The technique described is relevant to any organisation that accepts bank detail changes by email.

What to do now

  1. Require bank detail changes to go only through an authenticated self-service system, such as the MyView process the council already had. Do not accept workarounds when a requester claims they “cannot access” it.
  2. Check the requester’s email address and any submitted address against your existing records before acting. The Courier says this check was missed.
  3. Treat repeated urgent requests as a warning sign, as the council’s report does, according to the Courier.
  4. Do not email payslips or other personal data to a contact that has not been verified.
  5. Write down your bank detail change process. The Courier says the lack of a written process was among the weaknesses the report identified.

Sources