/ 19 March 2009

Fraudsters hack Cipro database

South Africa’s company registration database has been plagued by fraudsters who have appointed themselves directors of South African companies.

The Companies and Intellectual Properties Registration Office’s chief executive Keith Sendwe says Cipro is pursuing over 100 cases.

Cipro’s information security officer, Sampie Pretorius, says the number of fraud cases is growing and that Cipro has been engaging with the Scorpions and the National Intelligence Agency on this matter since 2007. He says some Cipro staff members had received death threats.

Pretorius says the fraud has escalated from “random and opportunistic” a few years back to “severe and ruthless” in the past 12 to 16 months.

“They mostly appear to have something to do with construction-related enterprises,” says Pretorius.

The fraud seems to hinge on the online CM29 form used to change directors in a company, which was withdrawn by Cipro in February this year.

A notice from Cipro dated January 25, 2009 says: “In our attempts to prevent fraudulent activities, it came to our attention that certain areas on our website are not well protected against fraud.

“One of the areas is the electronic submission CM29. System changes are required to enable us to provide a well-controlled electronic environment to our clients.”

Meanwhile Cipro’s decision to withdraw the electronic service for CM29 that was being used by the fraudsters is causing mayhem for corporate South Africa.

The Mail & Guardian spoke to numerous auditing firms this week that have to deal with Cipro on a regular basis and all bemoaned the backlogs and delays that have been experienced.

Hayley Newton-Holroyd, a director at RW Irish-Alliott, says that two of her clients had been subjected to fraud after the registered address and directors’ names had been changed on Cipro’s website.

Newton-Holroyd says although RW Irish-Alliott brought these cases of fraud to the attention of Cipro when they were discovered during December last year, they have still received no feedback and Cipro is still showing the incorrect directors.

“These companies are stuck because they can’t obtain new finances or enter into lease agreements until this issue is sorted out,” says Newton-Holroyd. “Besides, the fraudsters could attempt to open a new bank account in the companies’ names or open accounts with suppliers so they can get goods on credit and then never pay for them.

“These cases of fraud could be quite widespread,” says Newton-Holroyd. “It seems it is a bigger problem and they [Cipro] are not talking about it.”

“We are very aware of the implication on companies and have engaged several large entities in identifying the perpetrators,” says Sendwe. “Relevant information has been handed over to the relevant law enforcement agencies for further investigation and action.”

Sendwe says Cipro is engaging with a number of government bodies and accounting organisations to sort the matter out.

The M&G understands that the South African Institute of Chartered Accountants (Saica) engaged Cipro on this issue after its members brought it to Saica’s attention, but that Cipro has failed to provide feedback to Saica.

Sendwe says Cipro is in the process of implementing new technology and systems that will prevent these fraudulent activities.

“Cipro’s current systems are not fully protected against fraud and Cipro is in the process of adding some checks and balances to improve verification and tracking of customer records,” says Sendwe. “The disabling of the electronic change of directors is, however, only a temporary measure, which should be completed within the next month.”

“Cipro has apologised for the inconvenience,” says Sendwe. “However, in the interest of the integrity of the registered enterprises, this temporary measure had to be taken.”

Staff from an accounting and auditing firm who chose to remain anonymous say that, since the electronic submissions were withdrawn, Cipro processes had slowed down.

“The e-filing system worked really well but they obviously didn’t check all the loopholes,” says one staffer, who complained that what used to take 24 hours could now take up to four weeks.

“We have been waiting for some changes to be made that should have taken three weeks,” says one accountant. “It has been almost six months and they have still not been implemented.”

Sendwe says that in some cases Cipro is experiencing backlogs, mostly because of outstanding documents from clients or because contact details of clients are incorrect.

An accountant says that important documents are regularly lost at Cipro and that when there are problems the staff at Cipro expressed little interest in assisting users.

Sendwe says that lost documents may be possible in a few cases, especially where fraud is suspected, but that Cipro’s documentation is available and on record.

Sendwe says it is unfair to generalise about Cipro staffers’ attitudes and that all staff members are regularly sent on customer relationship management training.

“Over the past year complaints have decreased and compliments for staff members have increased drastically,” he added.