Invoice fraud: how payment-detail scams work and how to stop them

Invoice fraud does not need any hacking skill on your side to succeed. Someone in accounts receives an email that looks like it came from a supplier they pay every month. It says the supplier has moved banks and gives new details. The next payment goes out as normal, to the wrong account. The FBI's Internet Crime Complaint Center reports business email compromise losses in the billions of dollars every year, more than most other cybercrimes it tracks.

How the scam usually works

1. Access or imitation. The fraudster gets into a supplier's mailbox, or registers a lookalike domain (rivet-global.co in place of rivet.global, for example).
2. Watching. With mailbox access, they read past invoices and learn names, amounts and timing.
3. The change request. Just before a payment is due, "the supplier" sends new bank details, often with an urgent reason: an audit, a bank merger, a frozen account.
4. The payment. Your team updates the record and pays. The money is moved on within hours.

Variants include fake invoices from a "new" supplier, emails imitating your own CEO asking for an urgent transfer, and fake payroll changes from "employees".

Warning signs

• Any change of bank details, especially near a due date
• A new account in a different country from the supplier
• Pressure to pay today, or to keep the request quiet
• A sender domain that is one character off
• Account name on the new details that does not match the supplier's legal name

Controls that work

Call back on a known number. Every bank-detail change gets a phone call to a number from your existing records, never one from the email. This single rule stops most cases.

Two people for new payees. One person enters a new or changed payee, a second approves it. Keep the approver out of the email thread.

Name checks. Where the payment system offers Confirmation of Payee or Verification of Payee, treat a no-match result as a stop. See how Verification of Payee works.

Test payments. Send a small amount to new details and have the supplier confirm it by phone before the full payment.

Remittance advice. Send a remittance advice to your known contact after each payment, so a missing payment is noticed fast. The remittance advice guide shows a template.

If it happens

Call your bank at once and ask for a recall. In the US, report to IC3 at ic3.gov; in the UK, to Action Fraud. Speed matters more than anything else. Then check how the fraudster got the information, starting with the supplier's email and your own.

Payment controls on Rivet

Rivet keeps a recipient book, so a payee's details are saved once and a changed account stands out. Every payout is priced and approved with your PIN before it is sent. See Payouts.