An HR services company lost nearly Dh50,000 after cybercriminals pretended to be Emirates Flight Catering (EKFC), a major catering company in the UAE.
EKFC has been informed about this fraudulent activity and is working with authorities, urging partners to stay alert.
The scam, which occurred last month, was discovered when the HR firm realized they were dealing with impostors who had cleverly imitated EKFC’s identity.
Stay informed with the latest updates. Follow KT on WhatsApp Channels.
The fraudsters used emails with almost identical domain names, project[at]vendor-emireteflightcatering[.]com and project[at]vendor-emiretesflightcatering[.]com, which included slight misspellings of “Emirates.” The sender’s name was displayed as “Emirates Flight Catering EKFC” to bolster credibility.
The HR firm, having previously collaborated with EKFC through a middleman, was told the caterer was “operational” and accepting direct partnership applications. The process seemed authentic, featuring a “refundable registration deposit” and a subsequent $300,000 bond requirement, mimicking real contractor procedures.
Funds were transferred to an account at a digital bank in Abu Dhabi under the name ‘Emirates Flight Catering EKFC,’ as per documents reviewed by Khaleej Times. How the fraudsters managed to open an account with such a name remains unclear.
In response, an Emirates Flight Catering representative informed Khaleej Times: “We have been alerted to fraudulent activities impersonating our company. We are cooperating with authorities to investigate and take legal action. We advise caution against unverified requests for funds or information. We do not charge any fees for supplier registration. More details are available on our website: https://www.emiratesflightcatering.com/procurement/”
Missed Warning Signs
The HR firm became suspicious when communication suddenly ceased. A closer examination of the emails revealed several red flags: no EKFC staff were copied, the domains were misspelled versions of the official emiratesflightcatering.com, and there was constant pressure to complete the transfer.
The victim, currently abroad, has yet to file a police report.
Cybersecurity company Kaspersky, which shared the case with Khaleej Times, emphasized how even experienced businesses can be deceived when criminals exploit familiar processes and trick users visually.
“Fraudsters often use minor details, like a misspelled domain or urgent payment requests, to rush victims into action,” said Maher Yamout, lead security researcher at Kaspersky. “Business email compromise (BEC) attacks are among the most expensive cyber threats globally, and the UAE is no exception.”
Safety Tips from Kaspersky
For Individuals
-
Always double-check domains before replying or transferring money.
-
Verify payment instructions via phone with known company contacts.
-
Require multiple staff approvals for large transfers.
-
Verify recipient’s business details on DED Dubai.
For Businesses
-
Implement cybersecurity awareness training year-round for employees.
-
Use brand monitoring tools to detect suspicious lookalike domains.
Worldwide Threat
Business email compromise schemes are increasing globally, with the FBI estimating billions in annual losses. In regions like the Gulf, where procurement is common, fraudsters find ample opportunities.
Kaspersky stressed the importance of promptly reporting such scams to police and banks to improve recovery chances and protect other businesses from similar traps.
