Invoice fraud is rising: practical steps businesses can take to stop fake payment scams

Criminals have discovered that it is often easier to trick a company into paying them than to break into its systems. Invoice fraud, also called business email compromise or payment redirection fraud, has become one of the most damaging types of cybercrime for organisations of all sizes.

By understanding how these scams work and putting a few practical controls in place, finance and operations teams can significantly cut the chance that money is sent to the wrong account.

How invoice fraud works in real life

Invoice fraud usually targets the point where money actually moves: supplier payments, contractor bills or recurring invoices. Attackers rarely rely on a single tactic, but most schemes follow a pattern where a legitimate payment is quietly diverted at the last minute.

In a common scenario, a criminal impersonates a regular supplier and emails the accounts team with a “new” bank account, then follows up with an invoice that looks genuine. If staff update the payment details without extra checks, the next transfer goes straight into the attacker’s account and is often moved out again within minutes.

Typical entry points attackers use

To successfully change payment details, criminals need information and credibility. They usually get this in one of three ways: compromising email, harvesting public data or tricking staff directly.

Sometimes attackers gain access to a supplier’s or customer’s mailbox through phishing or weak passwords. They then monitor real conversations and send a request for new bank details from the genuine account at a carefully chosen moment, such as right before a large invoice is due.

In other cases, scammers rely entirely on open information like company websites, social media and business directories. They identify who handles finance, learn the names of key suppliers and create convincing lookalike email addresses or invoices that imitate the layout and logo of real documents.

Red flags on invoices and payment requests

Because fake invoices are often well designed, spotting them relies on noticing small details and unusual behaviour rather than obvious spelling mistakes. Training staff to pause when they see these warning signs makes a big difference.

• Last minute bank detail changes:Any request to update an account number, IBAN or sort code, especially just before a payment is due.
• Unexpected urgency:Messages that insist funds must be sent today, threaten penalties or use pressure to bypass normal checks.
• Slightly altered email addresses:Extra letters, swapped characters or different domains that look close to the real supplier.
• Unusual tone or errors:A familiar contact suddenly writes in a different style, uses odd phrasing or includes mistakes that are out of character.
• Attachment-only messages:Emails that only contain an attachment with little context in the body of the message.

Strengthening processes around supplier payments

Technology alone cannot stop invoice fraud if people are allowed to change bank details with a single click. Strong processes, clearly documented and repeated, are the most effective defence and are usually inexpensive to implement.

One simple but powerful rule is that any change to supplier payment information must be verified via a second communication channel. For example, if the request comes by email, staff should confirm it by calling a trusted phone number from existing records, not from the email signature.

Segregation of duties and approval rules

Fraud becomes easier when one person can create, approve and execute payments. Segregation of duties means splitting these stages between at least two people, even in a small finance team.

At a minimum, consider requiring dual approval for new suppliers, bank detail changes and payments above a certain amount. Many accounting platforms and online banking portals support multi-person approvals that can be configured without major changes to workflow.

Making email harder to exploit

Email is still the main tool attackers use to set up invoice scams. While no security setting is perfect, a few practical measures significantly lower the chance that an attacker can read or manipulate real conversations.

Enable multi-factor authentication on all company email accounts so that a stolen password alone is not enough. Review mailbox rules regularly, because criminals who gain access often create hidden forwarding rules to copy every message to an external address or silently delete warnings.

Verifying suppliers from the start

Invoice fraud often succeeds because supplier records are incomplete or outdated. A basic onboarding checklist for new vendors can close many gaps that criminals try to exploit later.

Collect official contact information from a trusted source, such as contract documents or verified company registries, and record at least one phone number used specifically for payment queries. Make it a rule that this contact data is used for verification instead of whatever appears in an email.

Raising awareness across the whole business

Attackers do not only contact the finance team. They may approach project managers, assistants or sales staff who work with suppliers and ask them to “help” by forwarding an urgent invoice or updating bank details on their behalf.

Short, regular awareness sessions can help everyone recognise that payment information is sensitive and should never be changed informally. Sharing anonymised examples of near-miss incidents inside the company can make the threat feel real without blaming individuals.

What to do if you suspect or discover invoice fraud

Speed is critical if money has been sent to a fraudulent account. As soon as a problem is suspected, contact the bank, explain that you are a victim of fraud and ask if the transfer can be recalled or frozen. Provide transaction details and any evidence you have.

At the same time, inform senior management, your internal security contact or external IT partner, and the affected supplier. Their systems or accounts may have been compromised, and early cooperation improves the chance of recovering funds and preventing further misuse.

Reviewing and learning after an incident

Even a failed attempt is an opportunity to strengthen defences. After any suspected or confirmed case, review how the request entered the organisation, which checks worked and which controls were missing or ignored.

Update written procedures, adjust approval thresholds and, where necessary, tune email filtering or accounting system permissions. Make sure changes are communicated clearly, not just added to a policy document that no one reads.

Turning invoice security into a routine habit

Invoice fraud thrives on routine, predictable behaviour and unspoken assumptions that emails and documents are genuine. By making independent verification and dual approval part of everyday financial practice, organisations turn that weakness into a strength.

The goal is not to slow business to a halt, but to build simple habits that make it much harder for criminals to quietly redirect payments. With consistent processes, a little training and basic technical safeguards, most companies can stay ahead of this expensive type of scam.