One hoax press release, one $300 million hole in mining company

library
crime | hacking | security

Australian bank, ANZ, is involved in funding Whitehaven Coal’s open cut coal mine in northwest New South Wales (NSW).

That bank is most certainly not responsible for a press release declaring it had changed its mind about lending Whitehaven the A$1.26 billion it needed to open the new Maules Creek pit.

Rather, a fake press release came from Jonathan Moylan, a 26 year old translator from Newcastle, NSW and environmental activist who, up until his sentencing on Saturday, was facing up to 10 years in prison and/or a A$765,000 fine for the fraud.

Moylan, who was charged with stock market manipulation offenses, pleaded guilty.

Because of his expressions of contrition and professed ignorance about the financial repercussions triggered by his trick, the judge found that he was mischievous, rather than malicious.

Moylan was handed a suspended 20-month sentence and A$1,000 fine for the single email.

It sounds like that single email was pretty convincing.

It was sent from a domain that riffed on the ANZ Bank name, used the bank’s logo, and included the name of an ANZ Bank PR person – Toby Kent – along with a phone number, according to The Register.

That number was actually Moylan’s. When journalists called to confirm the details of his bogus press release, he said it was all hunky dory.

As the Sydney Morning Herald reports, the activist sent the email to 306 people, including 295 journalists at 98 media organisations.

Some of those Moylan contacted published or distributed stories about the purported bank decision, including in the Australian Financial Review and Australian Associated Press.

The market, for a short but adrenalin-stoked time, was horror-struck.

Whitehaven’s value dipped as much as 8.8 percent in a flurry of trading before the release was revealed as a hoax.

That translates into $314 million in Australian dollars (US$295 million, £174 million).

The stock rebounded quickly. Still, some pain was felt, the court was told, as day traders and, potentially, pension funds lost out.

What’s the takeaway?

To me, it comes down to journalists – or anybody who relies on internet-sourced data to do their work – needing to wise up about how easy it is to pull one over on people online.

Moylan’s ruse, regardless of the fact that he did it on behalf of the environment and public health, isn’t very different from other internet scams.

Australia just last month highlighted typical online scams and how to spot them with its National Consumer Fraud Week, headed up by the Australian Competition and Consumer Commission (ACCC), which does for Aussies what the FTC does in the United States.

Naked Security passed on the ACCC’s Top 5 Tips for identifying an online scammer.

But for journalists receiving phony PR releases, if a release is questionable, consider double-checking the phone number listed in the release.

It’s easy enough to look up the bank (by searching for its site yourself, not by clicking on a link embedded in an email – there be dragons, also known as possible malware!) and find the right PR person to contact, along with a legitimate phone number.