This article is for anyone in a small business who pays suppliers or sends invoices. Invoice fraud is one of the most costly scams small firms face, and it works because the emails look completely normal.
How the scam works
A criminal gets access to a supplier’s email account, or to yours, usually through a scam email or a reused password. They read the messages quietly and learn who pays whom, how invoices are sent and how people write.
Then, at the right moment, an email arrives saying the supplier has changed banks. Sometimes it is a genuine invoice with new bank details. Sometimes it comes from an address that looks almost identical to the real one. The money is paid, reaches the criminal’s account, and is moved on within hours.
Why it is hard to spot
The email may come from the supplier’s real address, because their account has been taken over. It may reply in the middle of a genuine conversation. The invoice may be the real document, with only the bank details changed. Nothing looks wrong, because almost nothing is.
The warning signs
- A request to change bank details, especially close to a payment date.
- Urgency: the payment must go today, or a discount will be lost.
- A slightly different email address, such as an extra letter or a different ending.
- A change in tone, spelling or signature compared with earlier emails.
- A request to keep the change quiet or not to call.
- An invoice that arrives as a link rather than an attachment, or asks you to sign in to view it.
One of these alone does not prove fraud. Two or more together should make you stop.
The one rule that stops most of it
Never change bank details on the strength of an email alone.
When a supplier asks to change their bank details, call them on a number you already have: from an earlier invoice, their website or your records. Not the number in the email, which may belong to the criminal. Ask them to confirm the change. It takes two minutes, and it defeats most invoice fraud.
Make this a written rule for everyone who can make payments, and tell your suppliers you work this way. Genuine suppliers will be glad you do.
Other simple protections
- Turn on multi factor authentication for every email account, so a stolen password is not enough.
- Check the rules in your mailbox now and then. Criminals often add a hidden rule that forwards or deletes emails.
- Make a small test payment to any new bank account and confirm it arrived before sending the full amount.
- Use your bank’s name checking service when it warns that the account name does not match.
If you think you have paid a fraudster
Act immediately. Call your bank on its official number and ask them to try to stop or recall the payment. The quicker you call, the better the chance of getting money back.
Then report it to the police fraud reporting service, tell the supplier, and get your email accounts checked. If your account was used, passwords need changing and the mailbox needs checking for hidden rules.
If your email was the one used
Sometimes the criminal uses your account to send fake invoices to your customers. If a customer tells you they paid a new bank account you never gave them, treat it as a security incident. Change passwords, check the mailbox and warn your other customers.
The short version
Invoice fraud relies on nobody picking up the phone. Make it a rule that bank details are only changed after a call to a number you already trust, and protect your email with multi factor authentication.
Train the people who pay
Most invoice fraud is stopped by a person, not a product. Spend ten minutes with everyone who can approve or make payments. Show them a real example of a fake invoice email, explain the phone call rule, and make it clear that nobody will be blamed for checking. People who feel they might get into trouble for questioning a payment are the ones who let fraud through.
It also helps to limit who can add or change a payee in your banking. Two people, or a delay before a new payee can be paid, adds another check at very little cost.
Worried an email might be fake? Call us on 01252 686 513 before you pay, or read about protection from cybercrime.
