Invoice fraud: how to spot it and stop it.
A supplier emails to say their bank details have changed. The email looks right, the invoice looks right, and the money goes to a criminal. Here's how it happens and how to stop it.
How it works
Most invoice fraud starts with a hacked mailbox, either yours or your supplier's. The attacker reads along quietly, learns who pays whom and when, then steps in at the right moment with a convincing request to pay a "new" account.
Because the email often comes from a genuine account in a real conversation, the usual advice to check the sender's address doesn't catch it.
Warning signs
- Any request to change bank details, however routine it sounds.
- Urgency: "please pay today", "our old account is frozen", "audit in progress".
- A sender address that's almost right, such as an extra letter or a different ending.
- A slight change in tone, sign-off or formatting from someone you know well.
- Requests to keep it quiet, or to reply only by email.
A simple rule that stops it
- Never accept bank changes by email alone. Call the supplier on a number you already have, never one in the email.
- Use two people for new payees and bank detail changes: one sets it up, another approves it.
- Send a small test payment first and confirm by phone that it arrived.
- Tell your customers on your invoices that your bank details will never change by email.
Your own mailbox matters too. Multi-factor authentication on every account is the single change that blocks most of the break-ins behind invoice fraud, and it's now mandatory under Cyber Essentials wherever it's available.
Criminals can also fake your address without hacking anything. Use the free email security checker to see whether your domain can be spoofed.
If you've already paid
- Call your bank immediately, or dial 159 to reach your bank's fraud team. The sooner they act, the better the chance of recovering the money.
- Report it to Report Fraud on 0300 123 2040, or Police Scotland on 101.
- Don't delete the emails. They show how the attacker got in.
- Find out whose mailbox was compromised, yours or theirs, before more invoices go out.
How I help
If a fake invoice came from your address, your mailbox needs checking now. My incident response starts with a fixed-fee first response of £795 to lock the attacker out and find out what happened. See also what to do if your business email is hacked.
Paid a fake invoice, or nearly?
Emergency response, usually starting remotely within the hour, with a fixed £795 first response.