Fraudster steals over £3,000 from Highland Council by impersonating employee

A fraudster successfully stole thousands from Highland Council exploiting ‘weak verification processes’ by posing as an employee.

The council was hit as part of a phishing scam back in September 2025, which targeted 12 schools across the region.

The incident was revealed in papers prepared ahead of the council’s audit committee meeting next week.

According to the report, most of the emails were blocked, but eventually one reached staff and then went on to payroll, where the scammer was able to latch on and exploit a weakness in the system.

The scammer convinced the council that they had been unable to access the employee self-service system, MyView, and to process a manual bank account change.

Payroll staff sent a bank mandate form and later emailed two payslips to the scammer without verification, resulting in a serious data breach.

The form contained several discrepancies but these were not spotted until the after the bank details had been changed on the system.

On September 26, 2025, the council uncovered the scam when the genuine employee reported that they had not been paid. Payments were suspended and an investigation was opened.

Improved staff awareness of phishing and fraud following serious breach

The corporate fraud team concluded that weaknesses in the payroll control framework directly contributed to both the loss of £3,321.41 and the unauthorised disclosure of personal data.

There were additional issues, including poor identity verification, inadequate supervisory oversight, reliance on manual processes, a lack of written procedures, and failures to recognise warning signs of fraud.

A council spokesperson said: “Following this incident, immediate action was taken to review our procedures and implement additional safeguards.

“The audit report contains an action plan which includes the management responses which have been agreed to address the audit findings and recommendations.

“This includes strengthening verification processes for bank account changes, introducing additional checks and oversight, and enhancing monitoring arrangements.

“We have also put in place further measures to improve staff awareness of phishing and fraud risks and are working with our payroll software provider on additional system-based controls.

“While this was an isolated incident, the findings have been used to strengthen our controls and procedures further.”