University of London

Fraudulent emails and purchase orders

An important message for existing and potential suppliers to the University of London

We want to alert you to a fraud scam that is targeting existing and potential suppliers of equipment to the University of London, as well as other Universities and businesses, nationally and globally. Please take the necessary precautions so that you are not a victim of this scam.

The scam operates in the following way:

  1. A supplier will receive an email or phone call requesting a quotation for specific item/s of equipment. These may be in large or small quantities and of low to high values
  2. Once the quotation has been provided, a purchase order is emailed to the supplier that bears resemblance to an authentic University purchase order
  3. The purchase order typically instructs delivery to an address that may or may not be affiliated with the University
  4. After shipping the item/s of equipment, the supplier never receives payment and is unable to retrieve the shipped products 

Identifying fraudulent emails and purchase orders

The following will be evident in these fraudulent emails and purchase orders:

  1. An incorrect domain name will be used to send emails and purchase orders. Ensure you verify the order is valid with the University and only accept orders from nominated individuals as per your agreed contract. We advise all suppliers to consult with their IT or cyber security advisors to ensure they remain vigilant and informed on how to identify a suspicious communication.
  2. The delivery address may or may not be a University address. Fraudulent addresses will typically be a domestic residence or a self-storage facility, often not anywhere near the University. Or, the delivery address may be a genuine University address, which is later changed or redirected. And note that we don't deliver direct to Halls of Residence.
  3. The email will often be poorly written with grammatical, spelling or language usage errors.
  4. Use of a false or unknown contact from the University may be used. If requests for quotations or purchase orders are received from a new University contact that raises your suspicion, please contact a member of the procurement team to verify the validity of the request. Do not contact the name/number used on the email/purchase order.
  5. The e mail may use names of the University’s senior management team or Board of Trustees as contacts – note that senior managers and Board members will never be the first point of contact in a purchasing query.
  6. Phone numbers (particularly mobile numbers) not associated with the University may be used. Typically a mobile number may be a “personal number” starting with “070”. The University will never use a mobile number as a first contact number for a purchase.
  7. The order can be for a variety of products and may be for products not normally purchased by the University. This includes laboratory or scientific equipment, medical equipment or supplies or musical instruments.
  8. Various quantities may be requested but many will be for large orders.
  9. Orders may request to ship priority or overnight.

If you are ever unsure about a quotation request sent by email, or the subsequent purchase order, please contact the University of London Procurement Team or a known University contact.

Please do not attempt to call any phone numbers contained within the fraudulent emails that purport to be University numbers as they may attract a service charge.

Advice For Suppliers

In addition to the above information, suppliers should note the following:

  1. If you are ever unsure about a quotation request sent by email, or the subsequent purchase order, please contact our procurement team or a known University contact
  2. Please do not attempt to call any phone numbers contained within the fraudulent emails that purport to be University numbers as they may attract a large, international service charge
  3. Consult with your IT or cyber security advisors to ensure all are informed on how to identify a suspicious communication
  4. Report the incident on Action Fraud, the UK’s national reporting centre for fraud and cybercrime in England, Wales and Northern Ireland.  You can report fraud or cybercrime using their online reporting service at any time; the service enables suppliers to both report a fraud and find help and support. You can also get help by calling 0300 123 2040 to speak to their fraud and internet crime specialists.  When you report to Action Fraud you will receive a police crime reference number. Reports taken are passed to the National Fraud Intelligence Bureau. Action Fraud does not investigate cases and cannot advise you on the progress of a case.

What we are doing 

The University is reporting all instances of known fraudulent activity to the Police via Action Fraud.

University Security teams at all Senate House delivery points have been notified of this fraudulent activity and remain vigilant with all deliveries to the University, flagging up any unusual or suspicious deliveries.

We are compiling evidence for all reported incidents. If you have received any suspicious emails we would also be very grateful if you forward to procurement@london.ac.uk so these can be added to the evidence file.

We are contacting existing suppliers that may be subject to this type of fraudulent activity in order to raise awareness and provide basic guidance on how to deal with it. 

Keeping relevant University of London staff members aware of all activities and updates to this situation.