Invoice fraud, also called payment diversion fraud or business email compromise, is one of the most costly scams small businesses face. A criminal gets into a supplier’s mailbox, or creates a convincing copy of it, waits for an invoice to be due, then sends a polite email saying the bank details have changed. Your team pays the invoice, and the money goes to the criminal. There’s a simple rule that stops almost all of it, and a few technical controls that make the attack much harder in the first place.

How the scam works

  1. Access. The criminal phishes a password at a supplier, a customer or your own business, or registers a domain that looks almost identical (for example, a 1 in place of an l).
  2. Watching. With access to a real mailbox, they read past conversations quietly, sometimes for weeks, learning who pays whom, when, and how people write.
  3. Hiding. They often set up inbox rules that move replies into a hidden folder, so the real account owner doesn’t see the conversation.
  4. Striking. At the right moment, they send a message in the supplier’s style: “We’ve changed banks, please use the new details for this and future invoices.”
  5. Cashing out. The payment lands in an account they control and is moved on quickly.

Because the email can come from a genuine account, using the right names, invoice numbers and tone, it often looks completely legitimate.

Warning signs

  • A change of bank details, especially close to a payment date.
  • Urgency: “please process today”, “the old account is closing”.
  • A sender address that is very slightly different from the usual one.
  • A reply-to address that doesn’t match the sender.
  • A request to keep things quiet, or to only reply by email.
  • Small changes in tone, spelling or signature.

None of these is conclusive on its own, and a careful criminal may show none of them. That’s why the rule below matters more than spotting the signs.

The one rule

Never change payment details on the strength of an email. Confirm every change by phoning the supplier on a number you already have on file, not one written in the email or its signature. Make it written policy, tell your accounts team they will never be criticised for checking, and apply it to directors too, because “urgent payment from the boss” is the same scam aimed the other way.

Technical controls that make it much harder

  • Multi-factor authentication on every mailbox, so a stolen password alone doesn’t let anyone in.
  • Advanced email security that detects impersonation, look-alike domains and malicious links before they reach the inbox.
  • External email banners that clearly mark messages from outside the organisation.
  • SPF, DKIM and DMARC on your own domain, so criminals can’t send email that appears to come from you.
  • Alerts on suspicious inbox rules and forwarding, so a compromised mailbox is spotted quickly.
  • Short, regular training so staff recognise the pattern and feel confident to check.

Protect your customers too

Criminals don’t only impersonate your suppliers. If your own mailbox is compromised, they can send convincing invoices to your customers with their bank details instead of yours. Two simple steps help:

  • Put a short line on every invoice: “We will never change our bank details by email. Please call us on a number you already have to confirm any change.”
  • Set up DMARC on your domain, so email providers reject messages that pretend to come from you.

It reassures customers, and it makes it much harder for anyone to use your name against them.

If you think you’ve been caught

  1. Phone your bank straight away and ask them to try to recall or freeze the payment.
  2. Report it to Action Fraud.
  3. Reset the password on any mailbox that may be compromised, sign out all its sessions and turn on MFA.
  4. Check for inbox rules and forwarding you didn’t set up.
  5. Warn the supplier or customer, because their mailbox may be the compromised one.
  6. Consider whether personal data has been exposed. If it has, you may need to report it to the ICO within 72 hours.

Close the door before it’s tested

We set up MFA, email filtering, domain authentication and mailbox alerts for businesses across Kent as part of our cyber security services. Ask for a free email security check, and we’ll tell you whether someone could send email pretending to be you today.